Attackers stole personal data on most of the people listed in Denmark's Central Person Register by misusing the search access of a private Danish company, the government said, BleepingComputer and TechCrunch reported Monday. BleepingComputer put the number affected at about 8.8 million; TechCrunch said about 8 million.

What Happened

The Central Person Register, known as CPR, holds about 11 million records. That is far more than Denmark's population of roughly 6 million, because the register also covers people living abroad and people who have died, some entries going back decades, TechCrunch reported. BleepingComputer said the breach touched about 80% of those records.

The stolen information includes names, addresses and CPR numbers, the 10-digit identifier assigned to every person in the register. BleepingComputer reported that dates of birth and marital status were also exposed.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

The theft took place in September and was discovered on Oct. 2. Authorities assessed its scope over the following weekend and announced it Monday.

The attackers did not break into the register itself. According to the government, they abused the lawful access of a Danish company that was permitted to look up information in CPR; Danish businesses can query the register for verification purposes. The Danish Data Protection Agency said the attack involved some form of brute-forcing to find valid CPR numbers and then pull the data attached to each one, BleepingComputer reported.

The company's access has been cut off, additional security measures have been added to the CPR system and police have opened an investigation. The government has not named the company or said who was behind the attack. People who had registered for name and address protection were not affected, Help Net Security reported.

Why It Matters

The CPR number is a lifelong identifier that Danes use to deal with banks, health care, tax authorities and other public services. A leak that pairs those numbers with names and addresses for most of the population gives fraudsters material for convincing phishing calls and messages. TechCrunch said the incident is thought to be the largest data breach in Denmark's history, and compared it to the 2016 leak of Turkish citizens' data and repeated exposures of India's Aadhaar identity database.

The method also points to a structural weakness. Systems built to let approved companies verify identities at scale can be turned into a bulk extraction tool if one account is compromised or misused, and if lookups are not limited or monitored closely enough to catch enumeration.

Christina Egelund, the minister responsible for digitalization, called the breach an extremely serious incident and said she had informed the Danish Parliament's Business and Digitalization Committee. Help Net Security reported that she asked for a comprehensive security review of the CPR system.

Context

The disclosure came days after a separate breach at the Technical University of Denmark that may have exposed ID numbers for up to 200,000 people.

Authorities set up a dedicated cyber hotline and pointed residents to the government guidance site sikkerdigital.dk. They warned people not to give out passwords or confidential details in response to unsolicited phone calls or emails, even when a caller appears to already know their personal information.

What to Watch

Open questions include which company's access was abused and whether that company or one of its accounts was compromised, how long the enumeration ran before it was spotted, and whether the stolen data surfaces for sale. The Data Protection Agency's inquiry and the security review ordered by Egelund could lead to tighter rules on how private companies query the register.