Denmark's ID register spills more people's details than the country has residents
Abuse of private firm's access exposed 8.8M records, including those of people who had died or moved abroad
Unauthorized access to Denmark's Central Population Register (CPR) has exposed personal details of approximately 8.8 million individuals, surpassing the country's population of around 6 million. The breach, discovered on October 2, involved a private Danish company with legitimate access to the register. The CPR administration became aware of the irregular activity during September and assessed the extent of the breach over the weekend.
Digitization minister Christina Egelund stated that it was premature to determine if the country would issue new CPR numbers, a solution previously proposed. Cybersecurity expert Jan Kaastrup criticized the practice of treating CPR numbers as secrets, advocating for improved identification systems in a digitalized society. The company whose access was compromised was described as small.
Access to CPR data is granted under specific conditions in the Danish Civil Registration System Act, which applies to companies, foundations, legal entities, and individuals conducting business. However, access concerns a defined group of people, and recipients must comply with GDPR and Danish data protection laws. Greenland's approximately 55,000 residents, who also use CPR numbers for various services, are included in the database.
The ministry acknowledged that the register contains around 11 million records, including deceased or expatriate individuals, which accounts for the total exceeding Denmark's population. The CPR administration blocked the company's access and is collaborating with experts and authorities to investigate the incident. The ministry has informed the Danish Data Protection Agency, and police are conducting an investigation.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
