On Monday morning, the Ministry of Science, Higher Education and Digital Affairs announced in a press release that the CPR Office can confirm that 8.8 million people’s CPR data have been accessed.
A CPR number (from the Civil Registration System) is a unique 10-digit personal identification number given to all residents, similar to a social security number.
Alongside CPR numbers, people’s names and addresses have also been accessed. The breach occurred through a private Danish company that had been granted legal access to the database.
Access for almost two weeks
In the press release, the Ministry confirmed that it had been made aware of the breach last Friday and had spent the weekend establishing the facts of the case.
The Ministry confirmed that the unauthorised parties, about whom no details are yet known, had access to the data for ten days in September. During this period, 8.8 million people’s data were accessed.
This number is so high (higher than the Danish population) because it includes deceased people as well as people who have moved out of Denmark. Altogether, the CPR register holds data on roughly 11 million people.
The access was obtained through a private company that had been granted legal access to the CPR register.
Private companies with a legitimate interest are entitled to receive information from the CPR about a larger, defined group of people whom the company has already identified individually, either by personal identification number, date of birth and name, or by name and address.
Minister speaks out
Minister for Science, Higher Education and Digital Affairs Christina Egelund of the Moderates (Moderaterne) wrote in a statement, “It is a deeply serious incident, which is why I have also informed the Danish Parliament’s Committee on Business and Digitalisation about it.
“Together with all relevant authorities, we are in the process of mapping the full extent of the incident.”
Also concerned about the breach is Jens Myrup Pedersen, a professor of cybersecurity, who told DR that this constitutes “the largest ever breach of the Danish CPR register”.
Stay vigilant
Authorities are warning Danes (and anyone else in the CPR register) to stay vigilant against phishing attempts by malicious actors.
With the data now leaked, it may well fall into the hands of scammers and hackers, so it is important to be careful with unknown callers as well as suspicious emails and text messages.
The incident has been reported to the National Special Crime Unit, which will investigate how it happened, who the unauthorised actor is, and what has happened to the leaked data.
