The Danish newspaper Politiken is responsible for a dramatic development in the massive data-leak story that has dominated coverage in Denmark since Monday.
On Monday, the Ministry of Science, Higher Education and Digital Affairs released a press release in which it confirmed that the CPR register had been hacked and that 8.8 million people’s data had been taken (it now appears that 8.7 million is a more accurate figure).
CPR is a personalised ten-digit number that everyone living in Denmark must have. It is used for identification and for various public and private services, from healthcare to banking.
Politiken has now been in contact with the hacker behind the incident and can report a series of interesting details about the case.
Who is the hacker?
The hacker, whom Politiken contacted via an encrypted messaging app in English, proved their involvement by sharing breached information on 8,749,975 people.
It is unknown who the hacker is or what they intend to do with the data. Politiken asked whether they intended to sell the data, to which the hacker responded, “Not really. I don’t have any good ideas for what they can be used for.”
The hacker told the newspaper that they had got the idea to hack into the CPR register on 10 September and, within a few hours, were able to access it, with entry confirmed on 11 September.They then continued to have access over a ten-day period.
An expert Politiken spoke to, Carsten Schürmann of the IT University of Copenhagen, said of the hacker, based on their approach, “It’s definitely not a school student behind it.”
How did they gain access?
The hacker confirmed that they gained access to the registry through a small Danish company that had been given legitimate access to it.
Through a previous data leak, the hacker found one of the company’s former employees’ passwords, which was “123456”, and this granted the hacker access to the registry.
The names of the company and the former employee have not been made public. However, DR has confirmed in a separate article that the company is a small IT firm based in Funen (Fyn).
The hacker then created two programmes that were used to automatically send CPR data requests to the registry by guessing potential CPR numbers.
These made a total of 14,919,352 searches, which returned a total of 8,749,975 results.
What did the hacker say?
In written responses to Politiken, the hacker said of the security system, “They handle an entire country’s personal data with less care than one would treat a Pornhub account.
“My first instinct was just to tell them, but then they would probably just have changed the password to ‘1234567’.”
The hacker also said, “I’ll sum up the whole situation like this: Someone leaves a suitcase containing 10 kilos of plutonium unattended at a train station.
“Then a homeless person steals it. Yes, of course you shouldn’t steal other people’s suitcases. But you also shouldn’t leave nuclear material at a train station.”
What are the experts saying?
Experts Politiken has spoken to have raised concerns about the breach.
Schürmann said, “I think this case raises the question of whether CPR numbers should be secret. In Norway they have decided that personal ID numbers are not a secret, and perhaps Denmark should go the same way.”
Another expert they spoke to, Jens Myrup Pedersen from Aarhus University, said, “They apparently haven’t had control over the customers who have access to the CPR register. They apparently haven’t had control over their supply chain.
“And they haven’t had control over limiting the damage if someone has gained unauthorised access.”
And what about the politicians?
In a response to Politiken, the Minister for Science, Higher Education and Digital Affairs, Christina Egelund of the Moderates (Moderaterne), said, “The specific course of events is still being investigated by the relevant authorities.
“I therefore cannot comment on this part. But as I already emphasised on Monday, it is quite obvious that security in general has not been good enough. We therefore put a stop to unauthorised access, and measures have been taken that improve security here and now.
“In that connection, I also asked that a thorough security review of the entire CPR system be initiated.”
