Denmark’s Central Person Register (CPR) has disclosed a significant data breach affecting around 8.8 million individuals, marking a serious cybersecurity incident. This breach involves the unauthorized extraction of personal data from CPR, a system integral to Denmark’s national civil registration, which was initially established in 1968. This register holds details of approximately 11 million people, encompassing current residents, emigrants, and those who have passed away.
Details of the Breach
The data breach was officially announced on Monday, revealing that hackers exploited a Danish company’s legitimate access to the CPR system to steal personal data. Under Danish law, certain private companies are granted access to this register for business purposes, following strict regulations like the Data Protection Regulation and Data Protection Act.
The breach was uncovered on Friday when unusual activities within the system were reported, indicating that hackers had accessed sensitive information such as names, addresses, and CPR numbers. This unauthorized access occurred throughout September, and the information of registered individuals, both living and deceased, was compromised.
Immediate Actions and Investigations
Once the breach was identified, the CPR swiftly revoked the implicated company’s access and informed the Danish Data Protection Agency. An investigation was launched in collaboration with the police and other relevant bodies to assess the extent of the breach and implement remedial actions.
Individuals are being advised to be vigilant against any unsolicited requests for personal information, as such attempts may be linked to the breach. The CPR is reviewing and enhancing its security protocols to fortify against future threats, although the identity of the hackers remains unknown.
Future Implications and Security Measures
This incident underscores the critical importance of data security and the potential risks associated with lawful data access. As a response, the CPR is committed to strengthening its security measures to prevent recurrence and protect citizens’ personal data.
While the breach does not impact those who opted for the name and address protection, the scale of the breach highlights the challenges in safeguarding sensitive information from cyber threats. As investigations continue, the CPR emphasizes the need for heightened awareness and preventive strategies to mitigate the risk of identity theft and unauthorized data use.
This data breach follows other recent incidents affecting large populations, highlighting an urgent need for improved cybersecurity measures across various sectors.
