Hacker gained access to Danish CPR register for nearly 22 days
An unauthorised user had access to the Danish CPR register for nearly 22 days before the breach was discovered. Personal data on approximately 8.8 million Danes was exposed.
Unauthorised access to CPR register undetected for three weeks
An unauthorised user had access to Denmark's national CPR register from 10 September through to 2 October – a total of 21 days and 17 hours – before the authorities discovered the security breach. This emerges from documents which TV 2 has obtained, and which The Copenhagen Post also reports on.
Preliminary investigations suggest, however, that the unauthorised activity actually ceased as early as 20 September, roughly 10 days after access began. This appears in a report which the CPR office submitted to the Data Protection Authority.
The Ministry for Research, Education and Digitalisation announced on Monday that personal information belonging to approximately 8.8 million individuals had been exposed, including names, addresses and CPR numbers.
The breach occurred via a small Danish company with legitimate access to the register. According to DR, the company is based in Fyn and shares ownership and address with a larger company. The company's identity has not yet been officially confirmed.
The authorities discovered the incident when they received an unusually large invoice for lookups made via the company's account. Approximately 14 million CPR lookups had been carried out using the company's access credentials.
"The number far exceeds the company's customer base, and the company has indicated that they did not conduct the lookups themselves," the CPR office concluded in its report.
Private companies and organisations can obtain access to certain CPR information in exchange for payment.
Minister for Research, Education and Digitalisation Christina Egelund from the Moderaterne party acknowledged that security measures had been insufficient. She has requested a security review of the register in the wake of the breach.
According to DR, the company had not responded to enquiries by Friday morning.
Source: The Copenhagen Post