Denmark's ID register spills more people's details than the country has residents

An unauthorized individual exploited a Danish private company's authorized access to Denmark's Central Population Register (CPR), revealing personal details of about 8.8 million people. The breach was discovered on October 2, after irregular activity was noticed in September. The scale of the compromise was determined over the weekend.

CPR Minister Christina Egelund stated that it was premature to decide if the country would issue new CPR numbers, a solution suggested following the breach. Cybersecurity expert Jan Kaastrup criticized the practice of treating CPR numbers as confidential, suggesting they should not be the sole proof of identity in a digitalized society.

Egelund described the company with unauthorized access as "small." Businesses, foundations, and other legal entities can access CPR data under specific conditions set by the Danish Civil Registration System Act, but the ministry questioned why such extensive access was granted.

CPR numbers are essential for accessing public services and various transactions in Denmark, which has around 6 million residents. The database contains over 55,000 records of people living in Greenland who use these numbers for healthcare, tax services, and banking. The total of approximately 11 million records includes individuals who have passed away or moved abroad, explaining why the affected amount surpasses Denmark's current population.

The ministry disclosed that names and addresses of those who chose name and address protection were not exposed. The CPR administration revoked the unauthorized company's access and is collaborating with experts and authorities to investigate the incident. The Danish Data Protection Agency has been notified, and the police are conducting an investigation.