Danish CPR Breach Highlights Challenge of Supply Chain Risk
Attackers abused a Danish supplier account to expose CPR data on about 8.8 million people.
Denmark's Central Person Register was accessed without authorization after someone used a private company's legitimate search rights, the Ministry of Research, Education and Digitalisation said on October 5. The September incident exposed names, addresses, and CPR numbers for about 8.8 million people, including deceased registrants, in a country of roughly six million. Experts said one supplier account can bypass controls on a centralized national database and urged real-time monitoring of third-party access. Authorities warned citizens not to disclose passwords even if callers quote their CPR details.
- CPR stores names, addresses, family details, and national ID numbers.
- Unauthorized users abused a private Danish company's lawful search access.
- About 8.8 million living and deceased registrants were exposed.
- Experts call for continuous monitoring and tighter supplier permissions.
- Officials warn of follow-on phishing that quotes stolen CPR details.
Full article533 words · extracted from infosecurity-magazine.com · click to collapse
A mega breach that compromised personal information on 8.8 million Danes underscores the cyber risks posed by extended supply chains, experts have argued.
The incident affected the Central Register of Persons (CPR), a Danish government database containing basic details on the populace such as names, addresses, dates of birth, marital status, family details and a 10-digit CPR number.
A statement posted on October 5 by the Ministry of Research, Education and Digitalisation revealed that the CPR administration first noticed “irregular behavior” three days earlier.
“Over the weekend, the CPR administration became aware that unauthorized persons had gained unauthorized access to the names, addresses and CPR numbers of approximately 8.8 million registered persons (living, departed, deceased, etc.) in the CPR,” it noted.
“The unauthorized access occurred when unauthorized persons used a private Danish company's legal access to search for information in the CPR system within the framework of the information that private companies have access to.”
Read more on Danish government breaches: Danes Blame Bug for ID Leak Affecting 1.3 Million.
The breach, which occurred in September, may impact most of the Danish population, which currently stands at around six million.
Experts were quick to lay the blame on the CPR supply chain ecosystem.
“This incident demonstrates the inherent risk of highly centralized national databases when private companies are granted direct access to sensitive records,” said Dray Agha, senior manager of security operations at Huntress. “A compromised account at a single supplier can bypass an organization's core security controls and turn a legitimate connection into a massive data exposure.”
Agha added that governments and businesses must strictly limit what external partners are allowed to view, in order to mitigate these risks. “They must also monitor these systems continuously to detect unusual search patterns before millions of records are extracted,” he said.
Michael Centrella, head of public policy at SecurityScorecard, agreed that suppliers with access to sensitive systems should be monitored in real time.
“Vendor risk management cannot rely on static, annual reviews,” he argued. “To catch this type of abuse early, security teams must continuously monitor third-party access patterns and dynamically tie permissions to real-time risk posture."
Nathan Davies-Webb, principal consultant at Acumen Cyber, also cited “stronger authentication, shorter sessions, rate limiting data requests and creating a baseline of normal behavior” as being able to help with monitoring efforts.
Major Phishing Threat Looms
The Danish government urged citizens never to give out passwords or other sensitive information if requested via email, phone or other channels, even if their CPR number and other details are quoted.
Jamie Akhtar, CEO of CyberSmart, agreed, urging individuals to verify any such requests through an official website or known telephone number, and to check accounts for unusual activity.
“For the future, individuals should use unique passwords stored in a password manager, keep devices updated and make secure authentication a habit,” he concluded.
“Organizations must collect and retain only what they need, restrict access to what each user or supplier requires, and monitor for unusual activity. Regular supplier security reviews, staff training and rehearsed incident response plans should support these controls. This incident is a reminder that a trusted supplier’s access needs the same scrutiny as an organization’s own systems."