Denmark’s Central Register of Persons Exposes Personal Data of 8.8 Million Residents
What Happened
Unauthorized actors leveraged a small Danish company’s legally‑granted access to the Central Register of Persons (CPR) to conduct massive automated queries. Over a ten‑day window the company extracted names, addresses and CPR numbers for 8.8 million individuals – a figure that exceeds the nation’s population because the register also contains records of deceased persons and former residents. The breach was discovered after an unusually large invoice flagged “irregular behavior” in the system.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of excessive or poorly‑monitored third‑party access – a scenario continuous control‑assurance programs must detect, log, and review.
- Highlights the need for real‑time monitoring of privileged queries and automated alerts on anomalous usage patterns, supporting NIST CSF Detect and Respond functions.
- Reinforces the importance of defensible evidence (audit trails, access logs) to satisfy data‑protection authorities and internal audit requirements after a breach.
Who Is Affected
- Public sector agencies managing citizen registries
- Financial institutions that rely on CPR data for identity verification
- Any organization that outsources or contracts access to national identity registers
Recommended Actions
- Review all third‑party contracts and legal access rights to the CPR or equivalent registries.
- Validate that continuous monitoring, anomaly detection, and usage‑based throttling are enforced on privileged queries.
- Request a detailed incident‑response and forensic disclosure from the affected provider; update breach‑notification procedures accordingly.
Technical Notes
- Attack vector: Abuse of legitimate API/lookup access by a vendor with authorized CPR search rights; no exploit of a software vulnerability was reported.
- CVEs: None identified.
- Data types exposed: Full name, residential address, CPR number (unique ten‑digit identifier).
Source: DataBreachToday – Denmark Braces for Wave of Phishing Attacks