Unauthorized parties gained access to personal information linked to around 8.8 million people in Denmark after exploiting a company’s legitimate access to the country’s Central Person Register, authorities said Monday.
The exposed information includes names, addresses, CPR numbers and other data held in the system, according to the Ministry of Research, Education and Digitalisation.
The CPR, Denmark’s national civil registration system, has described the case as a “serious security incident.”
“It is a deeply serious incident, which I have therefore also briefed the Folketing’s Business and Digitalisation Committee about,” Minister for Research, Education and Digitalisation Christina Egelund said.
“Together with all relevant authorities, we are in the process of mapping the full extent of the incident.”
The ministry said unauthorized parties abused a Danish company’s lawful ability to search the CPR system. The CPR administration has since blocked the company’s access.
The incident took place during September, according to the ministry. The CPR administration became aware of the breach on Friday evening last week.
Nearly nine million records affected
The CPR system currently contains records for around 11 million people. That figure includes people currently living in Denmark, as well as people who have died or moved abroad.
Around 8.8 million registered people were affected by the unauthorized access.
The register can contain information beyond names, addresses and CPR numbers, including marital status, birth registration details, family relationships, affiliation with the Church of Denmark and information about legal incapacitation.
The ministry did not specify exactly which additional information was accessed in each case.
According to the review conducted so far, the names and addresses of people who have registered for name and address protection were not exposed.
Security review launched
Egelund said measures have already been introduced to reduce the risk of similar incidents.
“We have already launched initiatives in relation to the CPR that are intended to prevent similar incidents,” she said.
“In addition, I have requested that a thorough security review of the CPR system be carried out.”
The CPR administration is now working with specialists and other authorities to establish exactly what happened and the full scale of the breach.
The case has been reported to Datatilsynet, the Danish Data Protection Agency, and police are investigating.
Datatilsynet said Monday that it received notification of the incident from the CPR register on Sunday.
“As the case has only just been received and is still being processed, Datatilsynet currently does not have the ability to assess the specific circumstances or comment further on the case,” the agency said.
Egelund urged people in Denmark to remain vigilant in the coming period and to follow official digital security advice.