Unauthorized Access Exposes CPR Data of About 8.8 Million People in Denmark

Summary

Unauthorized parties used a Danish company's register access to retrieve data on about 8.8 million people. The administration cut off access, authorities are investigating, and the minister has ordered a security review.

Key points

• Access lasted about 10 days in September and used a private company's lawful access to Denmark's Central Person Register.
• Authorities say automated lookups sought valid CPR numbers; the ministry estimates about 8.8 million records were involved, a figure that is not final.
• The data included names, addresses, and personal identification numbers, though the ministry says access stayed within data available to private companies and excluded protected names and addresses.
• The register's administration stopped the company's access and reported the case to Denmark's data protection authority; police are investigating.
• Authorities have not said how the company's systems were accessed, who was responsible, or whether the data was retained or used.
• The minister said access safeguards were inadequate and ordered a full security review; the ministry says it has begun measures to prevent a recurrence.

People

Countries

Industries