Hackers steal records on 8 million people from Denmark’s central registry

The Danish government has confirmed that its central database of citizens’ personal data was breached and most of its contents stolen. The breach is estimated to affect around 8 million citizens and residents, including people living abroad and those who have died.

Minister Christina Egelund called the incident involving the Central Person Register (CPR) a “serious” one. According to her, the attackers managed to steal names, addresses, Danish social security numbers, and other information.

The CPR is a government database of Danish citizens’ information, including the state-issued identity number needed to pay taxes and access other services. Denmark’s population currently stands at about 6 million, yet the register holds records on roughly 11 million people, with some of the data going back decades.

How the access was gained

The authorities declined to name whoever is behind the attack. The breach occurred in September but was only discovered on October 2. What is known is that the unauthorized access was obtained by “abusing a Danish company’s lawful access to search for information in the CPR system.” Some companies in Denmark are granted access to the register in order to verify people’s details against government records.

The incident is believed to be the largest data breach in the country’s history. It joins a line of similar attacks on national identity databases: a 2016 breach affected millions of Turkish citizens, and data from India’s national Aadhaar system has spilled on several occasions.

Source: TechCrunch