Denmark's civil registry, the CPR, holds a record for roughly 11 million people, and in September someone read about 80 per cent of them. BleepingComputer reports that the register's administrators learned of it on 2 October and sized it over the following weekend. Names, addresses and CPR numbers are confirmed as exposed, and the same report lists dates of birth and marital status as well. The people covered include those who have emigrated and those who have died.
The login was real
This is the part worth sitting with. Early findings point to the attacker using the legitimate credentials of a private Danish company that has access to the register, then working through valid CPR numbers one by one and pulling the matching record. The company's access has been cut off, the police are investigating, and the minister, Christina Egelund, called it "an extremely serious incident" and briefed the parliamentary committee on business and digitalisation. A hotline has been opened for people who are worried, with guidance on sikkerdigital.dk.
There is no exploit in that story, no CVE and nothing to patch. There is a credential that worked, a lookup interface that would answer a very large number of lookups, and nobody watching the shape of the traffic. IT Security Guru frames it as a trusted third-party access problem, which is fair.
Why the data is worse than it looks
Name plus address plus national ID number is not a spectacular haul on paper. In practice it is the set of facts that banks, mobile operators and public portals use to decide whether you are you. The Danish authorities' own warning makes the point: do not hand over passwords or confidential details to anyone who contacts you unprompted, even if they already know your name, address and CPR number. That used to be a decent test of legitimacy. It no longer is for 8.8 million people.
Questions for your own estate
Most organisations we work with have some version of this: a partner, a processor or a reseller with a service account into a system holding a lot of personal data. A few things are worth asking this week.
- Which external parties can query a bulk personal-data system, and does each one have its own credential rather than a shared one?
- What is the per-credential rate ceiling? Eight million lookups from one account should fail long before the second million.
- Is there any alert on sequential or dense enumeration of identifiers, as opposed to the ordinary pattern of a few lookups tied to real customer events?
- Are partner credentials bound to a source network or a mutual-TLS client certificate, so a stolen secret is not enough on its own?
- Can you revoke one partner's access in minutes without a change ticket?
- Do the contracts with those partners give you the right to see their access logs?
None of that is exotic. Most of it was simply never prioritised because the partner was trusted, and the register had always been used sensibly. The Danish case is a decent reminder that a trusted credential in the wrong hands looks exactly like a trusted credential in the right ones, until you look at volume.
If you would like a second view on partner and service-account exposure, write to sales@halfteck.com.