Denmark Breach Exposes ID Numbers of 8.8 Million People

Denmark disclosed a major breach of the Central Person Register, or CPR, the national database behind every resident ID number in the country. Unauthorised users obtained names, addresses and CPR numbers for about 8.8 million people. The figure is higher than the Danish population of roughly 6 million because the register also holds records on people who have died or moved abroad. The attackers did not break into the CPR system directly. They abused the legitimate search access granted to a small private Danish company, a type of access Danish law allows for firms with a justified interest. According to The Next Web, the account made more than 14 million lookup attempts in ten days, and 8.8 million returned a record. Officials spotted the problem on October 2 while preparing to bill the company for the searches. The firm has been cut off, police are investigating, and Digitalisation Minister Christina Egelund has ordered a full security review. People registered with name and address protection were not affected. The CPR number is used for tax, healthcare and banking across Denmark, so the stolen data gives fraudsters a ready-made toolkit for phishing. Authorities are warning citizens to treat calls and emails with suspicion even when the caller knows their name, address and ID number. Officials say they have not yet decided whether to issue new CPR numbers. The lesson travels well beyond Denmark. UK and US businesses share data with suppliers, agencies and software vendors every day, and each of those connections is a door into your systems. Rate limits on lookups, alerts for unusual query volumes and regular reviews of who holds API keys would have flagged this activity far sooner. A billing run should never be your first security alert. If your business holds customer data, audit every third-party login and API key this month.