Denmark's ID register spills more people's details than the country has residents
Abuse of a Danish firm's CPR access exposed personal data on about 8.8 million people.
Denmark's Central Population Register said an unauthorized party abused a small private company's legitimate access and exposed names, addresses, and CPR numbers for about 8.8 million people. The register holds roughly 11 million records, including people who died or moved abroad, which is why the total exceeds Denmark's population of about 6 million; name-and-address-protected entries were not exposed. Officials blocked the company's access, notified the Danish Data Protection Agency, and police are investigating whether new CPR numbers must be issued.
- An unauthorized party abused a small firm's legitimate CPR access.
- About 8.8 million records were exposed, above Denmark's population.
- Data included names, addresses, and national identification numbers.
- Protected name-and-address records were not included in the exposure.
- Access was blocked; police and the data protection agency are investigating.
Full article388 words · extracted from theregister.com · click to collapse
security
Abuse of private firm's access exposed 8.8M records, including those of people who had died or moved abroad
An unauthorized party abused a private Danish company's legitimate access to the country's Central Population Register (CPR), exposing names, addresses, identification numbers, and other personal information about approximately 8.8 million people.
The CPR administration said in a statement [PDF] that it became aware on October 2 of irregular activity during September and established the scale of the breach over the weekend.
In a TV interview last night, digitization minister Christina Egelund said it was too soon to say whether the country would issue all-new CPR numbers, one of the solutions proposed following the breach.
REG AD
Danish cybersecurity specialist Jan Kaastrup told TV 2 that treating CPR numbers as secrets was a "broken" approach and argued that a number alone should not be accepted as proof of identity. "We live in a digitalized society, and therefore we should have much better identification systems," he said.
REG AD
Egelund described the company whose access was abused as "small." Private businesses can obtain CPR data under section 38(1) of the Danish Civil Registration System Act, subject to restrictions set out in the ministry's access terms [PDF]. Eligible recipients include companies, foundations, other legal entities, and individuals conducting business.
However, access concerns a defined group of people identified individually in advance, and recipients must be legally entitled to process the information under the GDPR and Danish data protection law. The Register asked the ministry why such broad access was given.
CPR numbers underpin access to public services and many everyday transactions in Denmark, which has a population of around 6 million people. The database includes the information of over 55,000 people living in Greenland who also use CPR numbers for healthcare, tax services, and banking. The ministry said the register contains approximately 11 million records, including people who have died or moved abroad, which explains why the affected total exceeds Denmark's current population.
The ministry also noted that names and addresses of persons who chose to register with name and address protection were not exposed.
The CPR administration blocked the unnamed company's access and said it was working with specialists and relevant authorities to establish what happened. It has notified the Danish Data Protection Agency, and police are investigating. ®