Denmark’s CPR breach

I suppose we need to get used to stories like this. Denmark has confirmed a serious incident involving its Central Person Register (CPR). Unauthorized actors obtained names, addresses, CPR numbers and other information relating to approximately 8.8 million registered people. That number is remarkable. Denmark has around 6 million current residents, but CPR contains roughly 11 million historical records, including people who have emigrated and deceased individuals. 

Photo: rawpixel.com na Magnific

For me, the most interesting part is the attack path. The attackers apparently did not directly compromise the Danish governments CPR infrastructure. Instead, they abused a Danish company’s legitimate access to query the register. Some private organizations are legally allowed to access CPR information for identity-verification purposes.

This is a textbook Third Party Risk problem. You may have excellent security protecting the central system, but if external organizations can legitimately query sensitive data, the effective security boundary becomes much larger.

The Danish authorities say the activity occurred in September and was discovered on October 2. The company’s access has been terminated, the incident was reported to the Danish Data Protection Agency, and the case remains under investigation. The regulator is specifically examining what happened and responsibility for the processing involved.

For me, this case illustrates something broader. Sometimes the supplier already has exactly the access the attacker needs. That makes controls such as least privilege, query limits, behavioral analytics, anomaly detection, and continuous monitoring absolutely fundamental.

Most importantly: organizations operating critical registers should assume that, at some point, one of their trusted partners will be compromised. Then architecture and monitoring should limit the blast radius.

I also immediately thought about Poland. I do not know enough about the architecture of Polish public registers and exactly which organizations have access to what data to make a direct comparison. But conceptually, the same risk exists wherever external organizations receive trusted access to centralized public information.

I'm asking whether we would detect a similar incident quickly enough and whether one compromised trusted party could access data at a comparable scale. This example shows that Cybersecurity doesn't end at the organizational boundary.

Author: Sebastian Burgemejster