8.8 Million Impacted by Data Breach at Denmark’s Central Person Register

The data breach at Denmark's Central Person Register involved unauthorized access through a Danish company that had lawful access rights under Danish law. Hackers abused this access to exfiltrate personal data of about 8.8 million registered individuals, including living and deceased persons. The stolen data includes names, addresses, and CPR numbers, which are equivalent to Social Security numbers. The breach was detected following abnormal activity notifications, leading to immediate termination of the company's access and notification of the Danish Data Protection Agency and law enforcement. The CPR system is reviewing and improving its security policies to prevent recurrence. The identity of the threat actor remains unknown.

The breach exposed sensitive personal information of approximately 8.8 million individuals, including names, addresses, and national identification numbers (CPR numbers). This data exposure could lead to identity theft, fraud, and privacy violations for affected individuals. The breach includes data of both living and deceased persons but excludes those who registered with name and address protection. The incident undermines trust in the CPR system and may have regulatory and legal consequences for involved parties.

CPR has revoked the compromised company's access to the system and notified the Danish Data Protection Agency and police. The organization is conducting an investigation and reviewing its security policies to enhance protections. Individuals are advised to be cautious of unsolicited requests for personal information. No further immediate action is specified by the vendor advisory; ongoing monitoring and policy improvements are underway.