Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
-
Authorities in Denmark have disclosed that unauthorized parties accessed the national population register, known as the Central Person Register (CPR), affecting roughly 8.8 million people. The country's digitalization ministry confirmed the incident on October 5.
According to the ministry, the exposed data includes:
- Names
- Addresses
- Personal identification numbers
The register covers both living and deceased individuals, which explains why the figure of 8.8 million exceeds Denmark's current population.
The key detail here is the attack vector: the intruders did not break into the register directly. Instead, they abused a private Danish company's lawful right to look up records in the CPR. In other words, a legitimate access entitlement granted to a business was leveraged to reach the data at scale.
The ministry has advised the public never to [follow the source link for the full guidance].
Source: The Hacker News
If a single compromised company account can expose a national register, how is your organization controlling and monitoring third-party or delegated access to sensitive data?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login