<![CDATA[Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account]]>Authorities in Denmark have disclosed that unauthorized parties accessed the national population register, known as the Central Person Register (CPR), affecting roughly 8.8 million people. The country's digitalization ministry confirmed the incident on October 5.

According to the ministry, the exposed data includes:

  • Names
  • Addresses
  • Personal identification numbers

The register covers both living and deceased individuals, which explains why the figure of 8.8 million exceeds Denmark's current population.

The key detail here is the attack vector: the intruders did not break into the register directly. Instead, they abused a private Danish company's lawful right to look up records in the CPR. In other words, a legitimate access entitlement granted to a business was leveraged to reach the data at scale.

The ministry has advised the public never to [follow the source link for the full guidance].

Source: The Hacker News

If a single compromised company account can expose a national register, how is your organization controlling and monitoring third-party or delegated access to sensitive data?

]]>https://xploitlk.com/topic/585/denmark-says-attackers-accessed-cpr-data-for-8.8-million-people-via-company-accountRSS for NodeTue, 27 Oct 2026 07:51:31 GMTTue, 06 Oct 2026 06:30:23 GMT60