8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
Hackers stole names, addresses, and national ID numbers of about 8.8 million people from Denmark's Central Person Register.
Denmark's Central Person Register is notifying about 8.8 million people that names, addresses, and CPR numbers were stolen. Hackers used a Danish company's lawful access to the national civil register, which holds records on about 11 million people; abnormal September activity was confirmed over the weekend. Individuals who opted into name and address protection were not affected. CPR cut off the company's access, notified the Danish Data Protection Agency, and opened a police investigation; the actor was not named.
- About 8.8 million living and deceased registrants had data stolen.
- Stolen data includes names, addresses, and CPR national identity numbers.
- Attackers abused a Danish company's legitimate access to the register.
- People using name and address protection were not affected.
- CPR revoked that access and notified police and the data regulator.
Full article296 words · extracted from securityweek.com · click to collapse
Denmark’s Central Person Register (CPR) is notifying roughly 8.8 million people that their personal information was stolen in a data breach.
Established in 1968, CPR is Denmark’s national civil registration system and contains information on about 11 million people, including residents, emigrants, and deceased individuals.
On Monday, CPR announced that hackers used a Danish company’s lawful access to the system to exfiltrate people’s personal information.
Under Danish law, private companies with a legitimate interest gain access to the CPR to obtain information on specific individuals. Companies may also request the information under the country’s Data Protection Regulation and Data Protection Act.
The incident was discovered on Friday, when the population register was notified of abnormal behavior within its system during September.
Over the weekend, the organization determined that hackers accessed the names, addresses, and CPR numbers (the equivalent of Social Security numbers) of approximately 8.8 million registered individuals, both living and deceased.
Advertisement. Scroll to continue reading.
The data breach does not affect individuals who chose to register with the name and address protection option, the national registrar says.
After discovering the incident, CPR immediately terminated the private company’s access, notified the Danish Data Protection Agency, and launched an investigation with the police and other relevant authorities.
The population register urges individuals to be wary of unsolicited communication requesting personal information, passwords, and other sensitive data.
CPR said it would review its security policies and improve protections to prevent similar incidents. It also noted that it could not name the threat actor behind the data breach.
Related: 250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms
Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People
Related: DC Health Agency Exposes 400,000 Beneficiary Records
Related: 23 Million User Records Compromised in Gyazo Data Breach