The Danish Central Personal Registration (CPR) authority has determined that unauthorised individuals accessed the personal data of approximately 8.8 million Danish citizens. The CPR system currently covers around 11 million registered citizens, meaning a significant portion of the total database has been compromised.
Among the compromised data are the names, addresses and CPR numbers of living, emigrated and deceased citizens. However, the unauthorised access did not include the names and addresses of citizens who had previously activated official personal data protection.
The breach was carried out by abusing the legal right to search data held by a private Danish company. The CPR authority immediately cut off access for the company in question, reported the incident to the Danish Data Protection Agency and launched a police investigation.
Irregularities in the system's operation were detected on Friday evening, 2 October, and it was also established that the unauthorised access took place during September. According to the hacker who contacted journalists, access was gained using the password of a former employee of a small Danish company, which had leaked into the public domain. The password was 123456, and according to the same claims, it was also used for administrative access to the system.
The hacker created two programmes to download and store data outside the system. He claims that the unauthorised access lasted from 10 September for a total of 21 days and 17 hours. These claims regarding the duration of access come from the attacker himself and have not yet been confirmed by an official forensic report.
