Denmark’s Central Person Register Breached, Exposing 8.8 Million Citizens via Compromised Supplier Access
What Happened — Unauthorized actors leveraged a domestic company’s legitimate credentials to query Denmark’s Central Person Register (CPR), extracting names, addresses and 10‑digit CPR numbers for roughly 8.8 million individuals. The activity was detected in early September and reported publicly in October.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of a single compromised supplier account bypassing an organization’s core security controls, a scenario continuous control‑assurance programs are built to detect and evidence.
- Demonstrates the need for ongoing third‑party access reviews, real‑time monitoring of privileged use, and auditable logs that can be presented during regulator‑led investigations.
- Highlights how a robust vendor‑risk framework provides defensible evidence that access is granted only on a need‑to‑know basis and is continuously validated.
Who Is Affected — Government agencies that maintain centralized citizen registries; any public‑sector entity that outsources data‑access functions to third‑party providers.
Recommended Actions
- Map the breach to the control objective of “manage third‑party access and continuously monitor supplier activity” and collect evidence of current oversight processes.
- Initiate an immediate review of all third‑party privileged accounts, enforce least‑privilege principles, and implement real‑time anomalous‑activity alerts.
- Document the incident response timeline and update the audit trail to satisfy regulator‑driven data‑protection reviews.
Technical Notes — Attack vector: compromised legitimate supplier credentials (third‑party dependency). Data exposed: full name, residential address, and CPR number (national identifier). No public disclosure of a specific vulnerability or malware. Source: The Record