Denmark’s CPR Reports Data Breach Impacting 8.8 Million Citizens

Denmark’s Central Person Register (CPR), the nation’s foundational civil registration system, has announced a significant data breach impacting approximately 8.8 million individuals. Attackers exploited a private Danish company’s lawful access to the CPR system to exfiltrate sensitive personal information.

The incident, discovered on Friday after abnormal system behaviour was noted in September, saw hackers gain unauthorised access to names, addresses, and CPR numbers – the Danish equivalent of Social Security numbers. The stolen data pertains to both living and deceased individuals registered within the system, which holds information on around 11 million people, including residents and emigrants. Individuals who opted for name and address protection within the CPR system were reportedly not affected by the breach.

Under Danish law, private companies with a legitimate interest can be granted access to the CPR to obtain information on specific individuals, in accordance with the country’s Data Protection Regulation and Data Protection Act. It was this legitimate third-party access that hackers reportedly leveraged to infiltrate the system.

Upon discovering the breach, the CPR immediately revoked the private company’s access and initiated an investigation. The Danish Data Protection Agency has been notified, and law enforcement, along with other relevant authorities, are now involved in probing the incident. The CPR has advised affected individuals to exercise caution regarding unsolicited communications that request personal information, passwords, or other sensitive data.

The national registrar has committed to reviewing its current security policies and implementing enhanced protections to prevent similar incidents in the future. At this stage, the entity responsible for the cyberattack has not been identified.