Denmark Data Breach Exposes Personal Records of 8.8 Million People

7 days ago by tardigrade to c/europe

Denmark has confirmed a major data breach involving its Central Population Register, known as CPR, after unauthorized parties accessed personal records belonging to about 8.8 million people. The exposed information includes names, addresses, and CPR numbers, according to an official statement published on October 5, 2026.

The figure exceeds Denmark’s population of roughly six million because the register also holds records of people who have moved abroad and those who have died. Officials said the CPR system currently contains approximately 11 million registered people, meaning the incident affected a large share of its records.

...

The attackers misused a private Danish company’s lawful access to search the CPR system during September. Authorities have not described how the unauthorized parties obtained or used that access, leaving the initial entry method unknown.

The confirmed route is important: this was misuse of an approved company connection, not a publicly confirmed software flaw in the register. The ministry has not disclosed the company’s name, linked the incident to a known threat group, or identified a specific vulnerability.

...

Research, Education and Digitalization Minister Christina Egelund described the incident as deeply serious. She informed Parliament’s Business and Digitalization Committee and requested a thorough security review of CPR. Officials said preventive measures had already started, without detailing their technical scope.

...

Names, addresses, and national identification numbers can make fraudulent messages and calls appear convincing. Cybersecurity News’ coverage of the Pentagon data breach similarly highlights the risks when personal records include identity numbers, while its phishing prevention guidance explains common warning signs.

...

Archived

generator 23 points 7 days ago

This is why we need age verification in the EU, so hackers don't need to attack individual countries.

But at least the children will feel safe.

path: 0 26177651, hotness: undefined, score: 23, children: 2
skvlp 8 points 7 days ago

Except that underage people (aka children) will be flagged in the data set and thus be easy to search.

path: 0 26177651 26177937, hotness: undefined, score: 8, children: 1
pmtriste 7 points 7 days ago

I think they were being sarcastic, saying the individual countries won't be hacked because the EU as a whole will be hacked.

path: 0 26177651 26177937 26178347, hotness: undefined, score: 7, children: 0
SorteKanin 19 points 7 days ago

For those who are not familiar with the Danish citizen register: Basically it's an ancient system made way before computers were a thing and it's just not been updated to modern standards because politicians never prioritize things before they blow up in their face.

The crux of the issue: In Denmark, your personal ID is not just an ID, it is also an access token. So you need to keep your ID number secret, otherwise others can use it to look up your personal information. Like, imagine your username was also your password, that's how dumb this system is. Add to this the fact that certain private companies get priveliged access to the citizen register for reasons and anyone with a few braincells could predict this happening 20 years ago.

path: 0 26180050, hotness: undefined, score: 19, children: 13
Ontimp 8 points 7 days ago

Haha I work in German government IT and have a colleague who likes to point to Denmark as an example for how good things could be here. I'll show him this next time he needs to put down the rose glasses.

That said, it's the same in Germany, only that citizen data is kept with municipalities, so we have ca. 11.000 different such shitty systems built decades ago instead of one - which makes it less attractive and damaging to compromise any given one, I guess.

At least, however, we don't have a citizen ID such as the one you describe, that could be used to identify people uniquely.

path: 0 26180050 26181533, hotness: undefined, score: 8, children: 7
helix 2 points 7 days ago

we don’t have a citizen ID

OK, so you forgot the Sozialversicherungsnummer and the Steuer-ID?

path: 0 26180050 26181533 26182267, hotness: undefined, score: 2, children: 1
Ontimp 3 points 7 days ago

They are not really the same though. These are domain specific identities. Sure, the tax office has your tax ID. But your municipality, the state health authorities or the retirement insurance will never ask you your tax ID, don't have access to it and are not allowed to process it. It's not a citizen ID that can be used to link different data sets and it's not saved in the Melderegister.

path: 0 26180050 26181533 26182267 26182456, hotness: undefined, score: 3, children: 0
theoretiker 2 points 7 days ago

With NOOTS Germany will move toward a less decentralized service with municipalities being able to share data between them more easily. I hope though that BSI pressures for it to be secure by modern standards.

path: 0 26180050 26181533 26185918, hotness: undefined, score: 2, children: 0
RichieRich 1 point 7 days ago

If you were to combine those two pieces of information, you could definitely identify a person unambiguously. Just because our government is too incompetent to combine the information doesn’t mean hackers won’t do it. But soon we’ll have the centralized BundID—to make things easier for hackers.

path: 0 26180050 26181533 26184708, hotness: undefined, score: 1, children: 1
Ontimp 2 points 7 days ago

I know and what I'm sayin is that this is by design. It's not only about competence, competence can be bought. It's structurally difficult because various different ministries and independent bureaucracies would need to decide to cooperate and do tedious work to combine data sets like this. It's not a magical antidote but a structural impedance that is supposed to make abuse more difficult, obviously not impossible.

And BundID does not entirely change to his. BundID does not assign you a unique identifier either. You get a temporary process-based ID that is generated as you apply for a government service and that is forwarded throughout the process. BundID itself only has a basic user name that you pick yourself and that is not used or stored anywhere outside it. The actual authentication is done via the eID, Elster certificate, etc. which all don't leave cryptographic traces.

Don't get me wrong, this system is still kind of broken. BundID still bundles important information in a central location and urgently needs modernization. And it's authentication amounts to 'trust me bro' from the POV of any other government service. But it does not introduce a global unique identifier either.

path: 0 26180050 26181533 26184708 26185588, hotness: undefined, score: 2, children: 0
SorteKanin 1 point 7 days ago

At least, however, we don’t have a citizen ID such as the one you describe, that could be used to identify people uniquely.

Oh don't get me wrong, there is nothing wrong with a citizen ID. Actually a citizen ID is very useful. It should just only be an ID and shouldn't give any access.

path: 0 26180050 26181533 26181614, hotness: undefined, score: 1, children: 1
Ontimp 5 points 7 days ago

Depends how much you trust the state. After the Nazi period, the German state is actually not allowed to keep persistent identifiers on people. You can only identify any. given citizen through a domain ID that may not be shared or used beyond a specific domain (e.g tax ID) or a combination of changeable attributes (address, name, etc.).

In practice this can be annoying, but it's also a useful precaution to prevent the government form easily pooling and linking information on citizens across domains and levels of state.

path: 0 26180050 26181533 26181614 26182522, hotness: undefined, score: 5, children: 0
KyuubiNoKitsune 3 points 6 days ago

In Sweden this info is public. Same ID format, but just using your name I can find out everything about you.

path: 0 26180050 26200548, hotness: undefined, score: 3, children: 0
wolfpack86 1 point 6 days ago

Well and the number space is your birthday and then 4 digits... But ending in odd numbers for men and even for women.

So it was already not very secure considering there's numerically only 5000 options once you know almost anything about a person you want to target.

path: 0 26180050 26198866, hotness: undefined, score: 1, children: 3
SorteKanin 1 point 6 days ago

That's only a problem because it is used as a password. If it was actually just a pure ID and didn't give access to any information, then it wouldn't matter. Okay, you could guess my ID if you had my birthdate - so what? The ID is useless, it's just an ID.

path: 0 26180050 26198866 26198986, hotness: undefined, score: 1, children: 2
wolfpack86 2 points 6 days ago

Yes of course.

I also don't understand why MitID got rid of username/password before phone authentication (like nemID had).

That was a bit of a regression

path: 0 26180050 26198866 26198986 26199218, hotness: undefined, score: 2, children: 1
SorteKanin 1 point 6 days ago

MitIDs password that doubles as an ID has also always been super weird to me. No idea why they did it like that.

Maybe so you don't need to remember both a username and a password? But that's such a pathetic reason.

path: 0 26180050 26198866 26198986 26199218 26199253, hotness: undefined, score: 1, children: 0
sp3ctre 7 points 6 days ago

People need to understand how f*king bad this is.

path: 0 26188775, hotness: undefined, score: 7, children: 1
BarneyPiccolo 2 points 6 days ago

We know, it happens in America nearly every day, and those are just the ones we hear about. I just assume bad guys already have every bit of data on me already.

path: 0 26188775 26190937, hotness: undefined, score: 2, children: 0
TankovayaDiviziya 7 points 7 days ago

Cybersecurity isn't taken seriously enough especially by the public sector. Most fraud aren't done the old school way of physical heist, it's done online now. AI and quantum computers will only make it worse.

That said, as much as people rightfully hate AI, there is a point that slowing down AI could be a matter of national security. For all we know, it could be a state actor involved in the hacking of the Danish registry. We must slow down the development of AI, but undemocratic bad faith actors who don't care about public opinion won't slow it down.

path: 0 26186970, hotness: undefined, score: 7, children: 0
AI_toothbrush 6 points 7 days ago

We dont have to worry about a similar thing happening in sweden cause our system is fucked up and everybody already has access to every registered(not even just citizens) persons name, address, phone number, etc.

path: 0 26181498, hotness: undefined, score: 6, children: 0
RedSnt 5 points 7 days ago

In a country of 6 million people, getting 8.8 million CPR numbers is impressive.

path: 0 26179911, hotness: undefined, score: 5, children: 1
ebber 4 points 7 days ago

The registry includes every single person has lived in Denmark at any point since 1962 or something, that's the actual reason for the larger numbers

path: 0 26179911 26186658, hotness: undefined, score: 4, children: 0
emptiness 5 points 7 days ago

Sounds like they went in through the front door. Great security there. At least one of Denmark’s neighbours provides similar access to companies.

path: 0 26178196, hotness: undefined, score: 5, children: 0
bstix 4 points 7 days ago

Having used the system some time ago, I'm not too worried. It only shows the name and latest address. Basically like the white pages but with a soc.sec.ID instead of the phone number.

It lacks info on a lot of people, because some people aren't too good at reporting when they move, and some are hidden for legal reasons.

The most dangerous thing would be if the data is sold to stalkers, because it does have more addresses than the white pages.

The soc.sec.no. includes birthday and gender, so it can also be used for targeting scams.

Anyway, it's not like this data wasn't already available in one way or another. The breach just made it easier for whoever did it.

path: 0 26186714, hotness: undefined, score: 4, children: 1
KyuubiNoKitsune 2 points 6 days ago

Ah, so the equivalent of the Swedish ratsit/eniro/mrkoll etc..

path: 0 26186714 26200524, hotness: undefined, score: 2, children: 0
CosmoNova 4 points 7 days ago

And this is exactly why saving all data about every citizen, including bank transfers and patient records in a single data base is a risk not worth taking. It‘s a terrible idea and simply proposing it already shows you don‘t know anything about keeping data and the people attached to it safe. Everyone knew this would happen. Painful incompetence on so many levels. And so very avoidable if you just didn‘t save it all in one place, under the same user IDs. A surveillance state comes at a terrible cost no matter who the government is at the time. It‘s a bad system.

path: 0 26180063, hotness: undefined, score: 4, children: 1
Rothe 1 point 6 days ago

Bank transfers and patient records weren't stored in the leaked database though. It was the ID-numbers, names and a physical address which was leaked.

path: 0 26180063 26188651, hotness: undefined, score: 1, children: 0
baconmonsta 3 points 7 days ago

I wonder how long they can keep the hacked company's name undisclosed

path: 0 26177782, hotness: undefined, score: 3, children: 0
trollercoaster 2 points 7 days ago

Wherever there is a feeding trough, the swine will come.

And a centralised registry of the entire population is a gargantuan feeding trough for data hungry digital swine.

path: 0 26178902, hotness: undefined, score: 2, children: 0
europe
europe

@feddit.org

login for more options
12172
12146
4780

News and information from Europe 🇪🇺

(Current banner: La Mancha, Spain. Feel free to post submissions for banner images.)

Rules

  1. This is an English-language community. Comments should be in English. Posts can link to non-English news sources when providing a full-text translation in the post description. Automated translations are fine, as long as they don't overly distort the content.
  2. No links to misinformation or commercial advertising. When you post outdated/historic articles, add the year of publication to the post title. Infographics must include a source and a year of creation; if possible, also provide a link to the source.
  3. Be kind to each other, and argue in good faith. Don't post direct insults nor disrespectful and condescending comments. Don't troll nor incite hatred. Don't look for novel argumentation strategies at Wikipedia's List of fallacies.
  4. No bigotry, sexism, racism, antisemitism, islamophobia, dehumanization of minorities, or glorification of National Socialism. We follow German law; don't question the statehood of Israel.
  5. Be the signal, not the noise: Strive to post insightful comments. Add "/s" when you're being sarcastic (and don't use it to break rule no. 3).
  6. If you link to paywalled information, please provide also a link to a freely available archived version. Alternatively, try to find a different source.
  7. Light-hearted content, memes, and posts about your European everyday belong in other communities.
  8. Don't evade bans. If we notice ban evasion, that will result in a permanent ban for all the accounts we can associate with you.
  9. No posts linking to speculative reporting about ongoing events with unclear backgrounds. Please wait at least 12 hours. (E.g., do not post breathless reporting on an ongoing terror attack.)
  10. Always provide context with posts: Don't post uncontextualized images or videos, and don't start discussions without giving some context first.

(This list may get expanded as necessary.)

Posts that link to the following sources will be removed

  • on any topic: Al Mayadeen, brusselssignal:eu, citjourno:com, europesays:com, Breitbart, Daily Caller, Fox, GB News, geo-trends:eu, news-pravda:com, OAN, RT, sociable:co, any AI slop sites (when in doubt please look for a credible imprint/about page), change:org (for privacy reasons), archive:is,ph,today (their JS DDoS websites)
  • on Middle-East topics: Al Jazeera
  • on Hungary: Euronews

Unless they're the only sources, please also avoid The Sun, Daily Mail, any "thinktank" type organization, and non-Lemmy social media (incl. Substack). Don't link to Twitter directly, instead use xcancel.com. For Reddit, use old:reddit:com

(Lists may get expanded as necessary.)

Ban lengths, etc.

We will use some leeway to decide whether to remove a comment.

If need be, there are also bans: 3 days for lighter offenses, 7 or 14 days for bigger offenses, and permanent bans for people who don't show any willingness to participate productively. If we think the ban reason is obvious, we may not specifically write to you.

If you want to protest a removal or ban, feel free to write privately to the admin that applied the rule (check modlog first to find who was it.)

go to feed...