Unauthorized access reportedly reached data on 8.8 million CPR registrants
SecurityUnverifiedUpdated:
Denmark’s CPR administration says information on about 8.8 million registrants was accessed without authorization. It describes misuse of a company’s legitimate search rights; the claim has not been independently verified here.
A company’s legitimate search access is misused
According to the CPR administration, unauthorized parties obtained access to data in Denmark's Central Person Register (CPR) by misusing a Danish company's lawful ability to search the system. The administration says the data included names, addresses, CPR numbers and other information for about 8.8 million registered people. It says names and addresses of people registered with name-and-address protection were not included in the unauthorized access.
A Danish company had lawful access to search the CPR system, but the supplied account does not provide a comparable broader baseline for the affected records.
The CPR administration says it has stopped the company's access after identifying what it describes as unauthorized access to CPR data, and says the case has been reported to the data-protection authority and is under police investigation.
The reported access concerns a national personal-data register and a stated total of about 8.8 million registrants. The CPR administration says it has revoked the company's access while specialists and authorities map the course of events.
Sources
- Hacker NewsDenmark Data Breach Exposes 8.8M People's Personal DataRead source →