On Monday, the Ministry of Science, Higher Education and Digital Affairs stated in a press release that the data of 8.8 million people (other reporting suggests 8.7 million) in the CPR register had been hacked.
This includes names, CPR numbers (unique 10-digit identification numbers), addresses and details of changes in the system.
On Friday, Politiken published an article containing quotes from the hacker, who had been in contact with the newspaper and described the hacking process.
The hacker confirmed that access to the database had been gained via a small company that had legitimate access to the register.
The password of one of the company’s former employees had been revealed in another tranche of hacked data as “123456”. This allowed the hacker to gain access to the register within a few hours of attempting to do so.
We now know more about the company and some of its other security failings.
Small company on Funen
The company through which the hacker accessed the data is a small limited liability company based in Odense on Funen called PAYS.
On its LinkedIn page, the company states that it helps Danish companies improve the quality of their data.
It also writes, “PAYS places extremely high importance on the security of your data. Trust PAYS to keep your data secure and to meet all your security requirements.
“All confidential data uploaded to or downloaded from PAYS is protected by SSL certification and proprietary encryption. All PAYS products are subject to and comply with applicable GDPR regulations.
“With us, you can easily process your data exactly as you wish, so you can best meet compliance requirements.”
Aside from the former employee’s account that used the password “123456”, Politiken has found that two other accounts for PAYS also used the same password, including an admin account.
Interesting company structure
The CVR register confirms that the company is wholly owned by Sophie Laursen ApS, which also owns PAYS ApS’s sister company, Charity Guard ApS.
On Charity Guard’s LinkedIn page, they write, “We are one of the world’s leading fundraising companies and communications experts for charitable organisations.
“We are socially conscious entrepreneurs. We create innovation, fundraising and change systems to solve social problems. We work purposefully to change the world for the better, while running a successful company.”
PAYS notes that it was created by Denmark’s leading communications company for charitable organisations: CharityGuard.
They also note that CharityGuard collaborates with most of the major Danish non-profit organisations.
PAYS also owns another company called StopSvindel ApS (meaning “Stop Fraud”), which has been developing an app.
Sophie Laursen speaks out
Sophie Laursen serves as the director and founder of Sophie Laursen ApS, the director of Charity Guard ApS (and its two subsidiaries), the director of PAYS ApS and the director of StopSvindel ApS.
In a written comment to TV 2, she said, “We can confirm that we are the company that has been subjected to an attack in which our lawful access to search for information in the CPR system has been misused.”
