Key points
- What the attacker claims, and what officials have confirmed
- Whose records were accessed
- What residents are being told to do
A person claiming responsibility for the Denmark data breach says they got into the CPR register, the country's national population register, through an account at the IT firm Pays ApS that used the password "123456." The government says the searches accessed names, addresses, and CPR numbers for about 8.8 million people.
The person told the Danish newspaper Politiken they had no intention of selling or leaking the data. Politiken reported that at least three Pays accounts, including an administrator account, used the same password. The government's notice doesn't mention the password, and Pays has confirmed only that its access was abused.
A small IT firm's legal access was abused
Denmark's digitalization ministry said on October 5 that unauthorized people had misused a private Danish company's legitimate access to search the Central Person Register, known as CPR. The company's access was cut off, the case was reported to the Danish Data Protection Agency, and police are investigating.
The government didn't name the company. Sophie Laursen, managing director of Funen-based Pays, confirmed on October 9 that the company's access had been exploited, The Register reported. Pays had authorized access to the register to validate business customers' records.
Earlier this month, the FBI removed a contractor, reported to be from Accenture (ACN), after a breach of its employees' data that the bureau blamed on a missed security patch. In South Korea, the president called for urgent action after hackers stole customer data from seven lenders, including about 25,700 Shinhan Bank customers.
What information the searches accessed
The ministry says the searches reached names, addresses, and CPR numbers, among other register data. CPR numbers are the 10-digit IDs that residents use with government agencies, banks, and healthcare providers, Insurance Journal reported.
Denmark has about 6 million people, but the register holds about 11 million records, including people who have died or moved abroad. The 8.8 million affected records cover living, emigrated, and deceased people. People registered for name and address protection weren't included, the ministry said.
The breach was detected 12 days after the searches ended
- September 10: The automated searches begin, according to documents obtained by the broadcaster TV 2.
- September 20: The last searches run, after about 14 million in all.
- October 2: The CPR administration notices the irregular activity and cuts off the company's access. A staffer had spotted an invoice showing unusually high activity from Pays.
- October 5: The government announces the breach without naming the company.
- October 9: Pays confirms its access was abused. Politiken reports the attacker's "123456" claim.
"This is a deeply serious incident," Digitalization Minister Christina Egelund said. She has ordered a security review of the CPR system.
Officials say a caller who knows your CPR number isn't proof of identity
The ministry told residents never to give out passwords or other confidential information over the phone, even when the caller appears to know their name, address, and CPR number. Egelund urged everyone to stay alert, now and in the months ahead, and to check the government's fraud guidance at sikkerdigital.dk.
The same site told businesses that a CPR number, name, address, or birth date alone isn't enough to verify a caller. It suggests checking identity through MitID, a one-time code sent to contact details already on file, or a callback to a known number.
