Denmark’s central database, the Central Person Register (CPR), has suffered a significant data breach, resulting in the theft of records belonging to approximately 8 million citizens and residents. This extensive compromise includes individuals living abroad and even deceased persons, making it potentially the largest cyber incident in the nation’s history.

The stolen information encompasses critical personal details such as names, addresses, and Danish social security numbers, alongside other sensitive data. Danish Minister Christina Egelund characterized the breach as a “serious incident,” highlighting the profound impact on national data security. While Denmark’s current population stands at about 6 million, the CPR system holds records for roughly 11 million people, with some data dating back several decades.

The unauthorized access, which occurred in September but was only detected on October 2, was reportedly achieved by exploiting a Danish company’s legitimate access to search information within the CPR system. The government has not disclosed the identity of the perpetrators behind the attack. This incident mirrors a growing trend of cyberattacks targeting national identity databases globally, drawing parallels to past breaches affecting millions of Turkish citizens and exposures from India’s Aadhaar database.

Key Takeaways

• The Danish Central Person Register (CPR) was breached, compromising data for approximately 8 million citizens and residents.
• Stolen information includes names, addresses, and Danish social security numbers, impacting both living and deceased individuals.
• The breach occurred by exploiting a third-party company's lawful access to the CPR system, highlighting supply chain vulnerabilities.

Editor’s Analysis & Impact

This significant data breach in Denmark underscores the persistent and evolving threat of cyberattacks against critical government infrastructure. The compromise of a central person register, containing sensitive identifiers like social security numbers, poses severe risks of identity theft and fraud for millions. For the cybersecurity industry, this incident highlights the crucial need for robust third-party vendor risk management, as the breach originated from an exploited company’s legitimate access. Governments worldwide will likely re-evaluate their data protection protocols and access controls, especially concerning external entities. The broader implication is a potential erosion of public trust in digital government services and a renewed focus on national cybersecurity resilience, pushing for advanced threat detection and incident response capabilities.

Frequently Asked Questions

Q: What kind of data was stolen in the Danish government database breach?
A: The stolen data includes names, addresses, Danish social security numbers, and other personal information belonging to citizens and residents registered in the Central Person Register (CPR).

Q: How did the hackers gain access to the Danish CPR system?
A: The unauthorized access was obtained by exploiting a Danish company's lawful access to search for information within the CPR system, indicating a potential vulnerability in third-party access management.

Q: How many people are affected by this data breach?
A: Approximately 8 million citizens and residents of Denmark are affected, including individuals living abroad and deceased persons, making it one of the largest data breaches in the country's history.