Denmark investigates data breach exposing personal information of 8.8 million people

Danish authorities have launched an investigation after unauthorised individuals gained access to personal information belonging to about 8.8 million people contained in the country’s Central Person Register.

Denmark’s CPR administration confirmed that attackers obtained access by abusing a private Danish company’s legitimate connection to the national database.

The exposed information included names, addresses and CPR identification numbers, which function as Denmark’s personal identification numbers.

The figure of 8.8 million is larger than Denmark’s current population of roughly six million because the database also contains records relating to people who have died or moved out of the country.

Authorities said people who had registered for official name-and-address protection were not included in the exposed names and addresses.

Authorities block company’s access

The CPR administration said it has stopped the affected company’s access to the system while specialists and government agencies investigate how the breach occurred.

The incident has also been reported to Denmark’s data protection authority, while police are investigating the unauthorised access.

Denmark’s digital affairs authorities described the incident as extremely serious and said officials were working to determine its full extent.

Cybersecurity experts have warned that information such as names, addresses, dates of birth and identification numbers could potentially be misused to make phishing attempts or impersonation scams more convincing.

The identities and motives of those responsible had not been publicly established at the time of the latest reports.