- A private company misused its legal access to Denmark’s national ID system, exposing millions of records.
- Names, addresses and CPR numbers were taken during unauthorized searches throughout September.
- Officials are warning people to watch out for scam calls and messages that use the stolen details.
Denmark is now investigating a serious data security problem. Unauthorized people gained access to names, addresses and personal ID numbers. The numbers belong to about 8.8 million people listed in Denmark’s Central Person Register (CPR).
A Company’s Legal Access Got Misused for Weeks
The Danish CPR administration confirmed the incident on October 5. Officials said a private company had legal access to the national registry. However, someone misused that access. Authorities have since stopped the company’s access to the system. The Danish Data Protection Agency and police are now looking into what happened, according to CPR’s official statement.
It is important to understand what the 8.8 million figure means. It does not show how many people currently live in Denmark. The CPR register actually holds records on roughly 11 million people. This number includes current residents, people who moved abroad and people who have died. Denmark’s real population sits at about six million, The Record reports.
So how did the breach actually happen? Authorities say someone misused a Danish company’s legal search rights. The Danish Data Protection Agency received a notice about this. A huge number of automated searches tried to find valid CPR numbers, the agency explained.
The CPR administration first noticed something odd on October 2. Investigators then traced the problem back further. They found that unauthorized access happened throughout all of September. During that time, information tied to roughly 8.8 million people was accessed, according to a BleepingComputer report.
Right now, officials have not named the company involved. They also have not said who carried out the unauthorized searches. Nobody has explained yet how the company’s legal access got compromised in the first place. The exact goal behind the activity also remains unknown.
Danish authorities did confirm which details got exposed. Names, home addresses and CPR numbers were all part of the accessed information. People who had already registered for name and address protection stayed safe from that part of the leak. Other rumors about additional stolen data are floating around online. However, people should treat those claims carefully since the investigation is still active, CPR noted.
Officials Warn of Scam Attempts Using Stolen Data
Danish officials are now urging people to stay alert. They want citizens to watch closely for phishing attempts, fraud and fake identity tricks.
Here is why this matters so much. Criminals could use real names, addresses and CPR numbers in their scams. This makes fake phone calls, emails or text messages look far more convincing than usual. Large-scale exposure of login and identity data can create similar risks, as shown by the exposed database containing 24 billion logins raises global cybersecurity alarm case.
Authorities have reminded people never to share passwords or payment details. This holds true even if a caller already seems to know personal facts about them, according to BleepingComputer.
Christina Egelund serves as Denmark’s Research, Education and Digitalization Minister. She called the breach a deeply serious matter. She has also ordered a full security review of the entire CPR system. Officials have started rolling out new steps meant to stop similar incidents from happening again, BleepingComputer confirmed.
Denmark Launches Full Security Review
This breach raises bigger questions too. Denmark runs one of the most digitized public systems in the world. People naturally wonder how safe that system really is. Still, no evidence currently links this incident to Denmark’s MitID digital identification system. That separate system appears untouched so far.
Investigators still have plenty of work ahead of them. They need to determine the full size of the breach. They also need to figure out exactly who was responsible. On top of that, they must track what happened to the stolen information afterward. Danish authorities have not yet decided whether affected people will need brand new CPR numbers, according to The Copenhagen Post.
A follow-up report from The Copenhagen Post added more context. Officials say it remains too early to make that call right now. The investigation needs to go further before any firm decision gets made, the outlet stated.
For now, Danish citizens should stay cautious. Anyone who gets an unexpected call or message should pause first. They should never hand over private details just because a stranger seems to know their name or address. Simple habits like this can go a long way.
Watching your bank accounts and ignoring suspicious links both help too. Denmark’s investigation continues, and more updates are expected as officials learn more.
