[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

6 clusters · 91 sources · 13 days · First seen · Last updated

Denmark CPR data breach and new security mandates

Overview

A major data breach within Denmark’s Central Person Register (CPR) has exposed the personal information of approximately 8.75 to 8.8 million records. The compromised data includes names, addresses, and personal identification numbers for 5.5 million living individuals and 3.3 million deceased persons. The total number of records exceeds the country’s population as it includes deceased individuals and residents living abroad.

Investigations have confirmed the breach occurred via a supply chain attack on the Odense-based IT company Pays ApS, which held legal access to the registry. The unauthorized access lasted from September 10 until it was shut down in early October. During this period, an attacker reportedly performed roughly 14 million automated searches using two custom programs, one of which an attacker claimed was written using an AI model. The breach was discovered on October 2 after a ministry staffer noticed an unusually high invoice, as each query incurs a cost. Sophie Laursen, director of Pays ApS, confirmed the company's account was the one compromised.

The intrusion was facilitated by severe security failures, including the use of extremely weak passwords such as ‘123456’ on at least three accounts, including one with administrator privileges. Initial access was gained via credentials leaked from a former employee. While individuals with name and address protection were not affected, others face increased risks of fraudulent communications. The perpetrator reportedly told the newspaper Politiken that they had ‘no intention of selling or leaking the stolen information.’

In response, Digital Affairs Minister Christina Egelund has issued strict security mandates to 1,039 companies with CPR access, requiring them to appoint security officers and monitor transaction volumes. Dansk Industri (DI) has advised businesses to transition toward more secure methods like MitID. As of early October, approximately 970,000 people had registered credit warnings to mitigate identity theft risks.

Entities

Denmark · Pays ApS · Central Person Register · Christina Egelund · Datatilsynet

Claims

What the coverage asserts, and how many sources carry each claim.

Coverage disagrees

Sources make claims that cannot both be true. CLSTR reports the disagreement; it does not decide who is right.

  • "Around 250,000 people were registered with a credit warning on October 1."

    vs

    "Approximately 970,000 people in the CPR register had created a credit warning as of Wednesday at 18:00."

    The claims provide different numbers for people registered with a credit warning (970,000 vs 250,000).

Timeline

  1. [TECHNOLOGY] 3 sources
    Denmark data breach exposes 8.8 million identities via weak password

    A cybersecurity breach in Denmark exposed the personal data of 8.8 million people after an attacker used the weak password ‘123456’ to access the national civil registration system via an IT firm.

  2. [TECHNOLOGY] 7 sources
    Denmark data breach exposes 8.8 million citizens' records

    A cyberattack on Denmark's Central Person Register exposed the data of 8.8 million people after an attacker used the weak password ‘123456’ to access an account at IT firm Pays ApS.

  3. [TECHNOLOGY] 18 sources
    Denmark CPR registry breach exposes data of 8.8 million people

    A cyberattack on Danish IT firm Pays ApS exposed the personal data of 8.8 million people in the national CPR registry, allegedly using the weak password ‘123456’ to gain unauthorized access.

  4. [TECHNOLOGY] 3 sources
    Denmark CPR breach exposes 8.8 million records via Pays ApS

    A data breach via IT firm Pays ApS has exposed the CPR information of 8.8 million people in Denmark, facilitated by weak passwords like '123456'. Authorities have issued new security mandates to over 1,000 much

  5. [TECHNOLOGY] 8 sources
    Denmark Central Person Register suffers massive 8.8 million record data breach

    A massive data breach in Denmark's Central Person Register has exposed the personal information of approximately 8.8 million people, prompting nearly one million citizens to register credit warnings.

  6. [TECHNOLOGY] 58 sources
    Denmark CPR register breach exposes data of 8.8 million people

    A major data breach in Denmark's Central Person Register has exposed the names, addresses, and CPR numbers of approximately 8.8 million people, including deceased and emigrated individuals.

Sources

all-about-security.de · arenait.net · b2b-cyber-security.de · biq.dk · blick.ch · brasilemfolhas.com.br · brusselssignal.eu · cafef.vn · canaltech.com.br · chiccheinformatiche.com · chip.com.tr · clubic.com · cyberinsider.com · datafloq.com · denkorteavis.dk · developpez.net · diarioestrategia.cl · DNA.fr · dominicanaaldia.com · europesays.com · fight.org · fr.euronews.com · generation-nt.com · gwg.ng · hardware.com.br · heute.t-online.de · himmerlandsposten.dk · hna.de · iguru.gr · infoenn.com · ing.dk · it-boltwise.de · jammerbugtposten.dk · journalducoin.com · justnerd.it · karar.com · kenh14.vn · Lalsace.fr · ledecodeur.ch · megafon.si · merca2.es · merkur-online.de · migogodense.dk · mobilsiden.dk · moncloa.com · n1info.si · netavisen-sjaelland.dk · netcost-security.fr

This summary has been updated 10 times: see revision history