Denmark says hackers reached 8.8 million people's records through a company's register access

A company account with search rights to a national register is as secure as the company that holds it. The government said the attackers took advantage of a system that allows Danish companies to search the CPR legitimately ^[3]. ITPro reports the suggestion is that they got in by targeting a private Danish company ^[9]. Dray Agha, senior manager of security operations at Huntress, said: "A compromised account at a single supplier can bypass an organisation's core security controls and turn a legitimate connection into a massive data exposure" ^[11].

One company's access reached most of the register. The 8.8 million exposed records ^[1] are about 80% of the roughly 11 million people the CPR holds ^[18]. That total includes people who have moved away and people who have died, against a resident population of about six million ^[7]. So at a minimum, roughly 2.8 million of the exposed records belong to people outside Denmark's current population ^[19].

Agha's remedy states the trade-off every operator of a shared dataset faces. Governments and businesses "must also strictly limit what external partners are allowed to view," he said, and "monitor these systems continuously to detect unusual search patterns before millions of records are extracted" ^[12]. Companies find a lookup service useful because it answers questions about people quickly. Each field hidden from partners, and each alert on search volume, slows the honest company down. The same limits cap what a stolen account can pull.

The evidence for late detection is thinner. According to ITPro, the attack was spotted on a Friday night, and CPR staff had observed irregular behaviour on the systems during September ^[6]. The government's statement followed on 5 October ^[2]. Nathan Davies-Webb, principal consultant at Acumen Cyber, called that discovery gap a highly concerning aspect of the breach ^[17]. "While this may not be a direct factor in this case, delays are common when a breach originates from a third-party," he said ^[17]. His own caveat is the objection a skeptic would raise, and in my view it stands. The government has not said when the access began or how many searches the extraction took. Whatever the cause, irregular behaviour was visible inside the CPR before the breach was confirmed ^[6]. Shortening that interval is the job of the search-pattern monitoring Agha describes ^[12].

This quarter's decision belongs to whoever runs partner access. Next quarter's cost is likely to land on the banks and public bodies whose names phishers borrow. Minister Christina Egelund warned Danes to "be aware now and in the future," and the government told citizens not to give passwords to unknown callers even if those callers know an address or CPR number ^[14]. Jamie Akhtar, chief executive and co-founder of CyberSmart, said Danes should watch for phishing emails, texts and calls claiming to come from banks or public authorities ^[16]. "Knowing your name, address or identification number does not make a caller trustworthy," he said ^[15].