[CLSTR]
< Back to all clusters
[TECHNOLOGY] · Denmark · 3 sources

started · updated

Part of situation: Denmark CPR data breach and new security mandates (6 clusters)

Denmark CPR breach exposes 8.8 million records via Pays ApS

CPR data breach Pays ApS identity theft Denmark cybersecurity data privacy

A major data breach in Denmark has exposed the Central Person Register (CPR) information of approximately 8.8 million individuals. The breach occurred through the IT company Pays ApS, where a hacker maintained unauthorized access for 21 days and 17 hours.

Investigations revealed that the breach was facilitated by extremely weak security measures, including the use of simple passwords such as '1234' and '123456' on multiple user accounts, including an administrator account. The hacker reportedly gained initial access via a leaked password from a former employee.

In response, the CPR Administration has issued security reinforcements to 1,039 companies that have access to the register. Minister Christina Egelund acknowledged that security protocols surrounding the CPR register were insufficient.

Dansk Industri has warned businesses that CPR numbers, names, and addresses can no longer be relied upon as sufficient documentation for identity verification, as the leak significantly increases the risk of credible fraud attempts against both citizens and companies.

Entities

CPR-registret · Christina Egelund · Danish Central Person Register · Dansk Industri · Denmark · Pays · Pays ApS

Claims

What the coverage asserts, and how many sources carry each claim.

  • [● 2 SOURCES] A hacker gained unauthorized access to the Danish Central Person Register (CPR) via the IT company Pays ApS. www.dr.dk · time.news
  • [○ 1 SOURCE] The CPR Administration sent security rule reinforcements to 1,039 companies with access to the register. www.dr.dk
  • [○ 1 SOURCE] Dansk Industri advised that CPR numbers, names, and addresses are no longer sufficient for identity verification. denkorteavis.dk
  • [● 2 SOURCES] The unauthorized access lasted for 21 days and 17 hours. www.dr.dk · time.news
  • [○ 1 SOURCE] Minister Christina Egelund acknowledged that security regarding the CPR register was insufficient. www.dr.dk
  • [● 2 SOURCES] At least three profiles at Pays ApS used the simple password '1234' or '123456'. www.dr.dk · time.news
  • [● 3 SOURCES] The breach exposed the CPR information of approximately 8.8 million people. denkorteavis.dk · www.dr.dk · time.news

Sources

Dansk Industri: CPR-læk øger risikoen for svindel mod virksomheder [denkorteavis.dk]
1039 virksomheder har fået indskærpet sikkerhed efter CPR-læk [www.dr.dk]
Denmark's Pays ApS used a simple password to breach 8. 8 million CPR Numbers [time.news]