Denmark's National Registry Breached via Third-Party Credential Misuse
Unauthorized access to 8.8 million records highlights critical vulnerabilities in third-party system integrations.
1National Registry Data Exposure
Denmark's Central Person Register, containing 11 million records, suffered a major security breach affecting 8.8 million individuals. The compromised data includes names, addresses, and unique 10-digit CPR numbers. Authorities confirmed the unauthorized access occurred through a third-party company's legitimate portal, though they have not verified the specific technical methods used by the attacker.
2Third-Party Access Vulnerability
The breach originated from the misuse of a private company's authorized access to the registry system. Danish authorities allow specific companies to query information for legitimate purposes, provided they identify individuals in advance. In this incident, the attacker exploited this existing legal gateway to extract massive volumes of sensitive personal data from the government database.
3The Role of Weak Credentials
An anonymous individual claimed responsibility, alleging they used a former employee's credentials to infiltrate the system. Reports suggest that at least three accounts at the involved company, including an administrator profile, utilized the insecure password '123456'. This highlights a catastrophic failure in basic credential management and authentication protocols within the third-party organization's infrastructure.
4Detection via Billing Anomalies
The intrusion was discovered only after a CPR administration employee flagged an unusually high invoice linked to the company Pays ApS. Investigations revealed approximately 14 million automated searches were performed within a ten-day period. This billing spike served as the primary indicator that the system was being subjected to large-scale, unauthorized data extraction scripts.
5Attacker's Perspective on Security
The alleged attacker expressed shock at the ease of access, comparing the registry's security to leaving plutonium unattended in a public train station. They claimed to have used two custom scripts to retrieve and store the data externally. Despite the breach, the individual stated they have no intention to sell or publish the stolen information.
6Expert Assessment of Credibility
Cybersecurity researcher Emil Hørning reviewed a sample file containing CPR numbers and deemed the attacker's account credible. He noted that the described methods for bypassing security controls are technically plausible. While this assessment does not independently verify every detail of the intrusion, it underscores the significant risks posed by current third-party access governance models.
7Scope of Protected Information
Not all data in the register was exposed during the incident. Authorities clarified that the unauthorized access did not include the names and addresses of individuals registered with specific name-and-address protection. The breach primarily impacted the broader population, excluding those who had previously opted for heightened privacy measures within the national system's administrative framework.
8Systemic Security Implications
This incident forces a re-evaluation of how government entities manage third-party access to critical infrastructure. The reliance on external companies to query sensitive national databases introduces significant attack vectors if internal security hygiene remains poor. Future policy will likely demand stricter authentication requirements and real-time monitoring of all third-party API or portal usage.