Denmark CPR Breach Exposed About 8.8 Million Records

Attackers misused Pays ApS access to Denmark’s population register, exposing names, addresses, and CPR numbers for about 8.8 million people.

Denmark’s digitalization ministry said unauthorized parties used a small private company’s lawful access to the Central Person Register and obtained names, addresses, and CPR numbers. Early accounts put the impact at about 8.8 million people—roughly four in five of a register of about 11 million records, including deceased people and people who moved abroad—while Politiken’s figure, carried by later outlets, was 8,749,975 records, about 5.5 million living and 3.3 million deceased. Sources disagree on the window: officials first described about 10 days of September lookups discovered on 2 October, whereas Politiken-based reports said access began on 10 September and lasted 21 days, or 21 days and 17 hours, after a former Pays ApS employee’s leaked password “123456” was used on at least three accounts, including an administrator. Malwarebytes said suspicious querying stopped on 20 September and that access was shut on 2 October after an unusually large bill, following about or more than 14 million searches and two programs that extracted and stored data. The company’s access was revoked, the Danish Data Protection Agency was notified—on 4 October according to Help Net Security—and police, including the National Special Crime Unit, are investigating; Minister Christina Egelund briefed Parliament and ordered a security review, with public discussion around 5 October. Name-and-address-protected people were not exposed, new CPR numbers were not yet decided, and officials warned the data could enable fraud even though the alleged attacker told Politiken it would not be sold or published.