Critical Vulnerability in Danish CPR System Exposed 8.8M Records

Key Takeaways

• A significant data breach in Denmark exposed approximately 8.8 million national identification records from the Central Person Register (CPR).
• The compromise originated from weak security practices at Pays, an IT company with authorized access to the CPR system, specifically the use of “123456” as an administrator password.
• The breach highlights the critical risk posed by third-party vendors with privileged access to sensitive national databases.
• The exposed data includes information for both living and deceased individuals, raising substantial privacy concerns despite the hacker’s claims of no intent to sell or publish.

Danish CPR System Compromised via Weak Password

A critical security lapse involving a commonly used password has led to a substantial data exposure within Denmark’s Central Person Register (CPR) system, affecting information linked to an estimated 8.8 million national identification numbers. The incident has been traced back to Pays, an IT firm located on the island of Funen, where at least three accounts, including an administrator profile, were reportedly secured with the notoriously weak password “123456.”

This event starkly illustrates how inadequate security protocols at an entity with trusted access can jeopardize a national database. Pays held legitimate authorization to query Denmark’s CPR, a comprehensive registry of personal information for individuals residing in or previously registered within the country. Rather than a direct breach of the CPR’s core infrastructure, an attacker exploited Pays’ credentials to extract personal records.

Unraveling the Danish CPR Breach

According to Politiken’s investigation, the individual responsible for the breach shared portions of the stolen data with the newspaper, asserting that the “123456” password facilitated access to CPR numbers and associated addresses. Politiken reported that 8,749,975 records were compromised, aligning with news coverage that cites the breach as affecting either 8.7 million or approximately 8.8 million individuals.

The compromised dataset encompasses details for roughly 5.5 million living individuals and 3.3 million deceased individuals. These figures are rounded estimates, reflecting the extensive scope of the CPR register, which maintains personal data for anyone who has lived in or been registered in Denmark.

The Copenhagen Post further detailed that the attacker gained entry through a leaked password associated with a former employee of a smaller Danish company. The hacker then allegedly developed two distinct programs to systematically retrieve and store CPR information externally. These specific technical details regarding the breach methodology are attributed to the hacker’s own account, as a formal forensic report has not yet been publicly released.

The unauthorized access reportedly commenced on September 10 and persisted for an alarming duration of 21 days and 17 hours. This extended window raises serious questions about the efficacy of existing monitoring controls, particularly their capacity to detect and flag repeated searches or unusual data extraction volumes before millions of records were exfiltrated.

Pays Confirms Misuse of Authorized Access

Pays ApS, headquartered in Odense, has officially confirmed to TV 2 that its legitimate access to the CPR system was indeed exploited. Sophie Laursen, the managing director and owner of Pays, acknowledged the incident via email, as reported by The Copenhagen Post.

Private sector entities and various associations are granted access to the CPR system when they demonstrate a valid operational need, such as verifying customer or member addresses. This operational model underscores the critical importance of robust security practices within each approved organization, as valid credentials can serve as a direct conduit to highly sensitive public records.

This incident bears a striking resemblance to the Veradigm third-party data breach, where stolen vendor credentials were used to download patient information through an authorized interface. While the underlying systems differ, both cases emphasize the necessity for stringent limitations and rigorous oversight of trusted third-party access.

Previous cybersecurity research concerning passwords frequently exploited in RDP attacks has consistently shown “123456” as a top offender. Although that research pertains to remote desktop access and not directly to Denmark’s CPR system, it reinforces the enduring utility of predictable passwords for malicious actors.

What You Should Do

• Enforce Strong Password Policies: Mandate complex, unique passwords for all accounts, particularly those with administrative or privileged access to sensitive systems. Block the use of common or easily guessable passwords.
• Implement Multi-Factor Authentication (MFA): Require MFA for all accounts, especially those with access to critical data, to add an essential layer of security beyond just a password.
• Promptly Deactivate Former Employee Accounts: Establish and adhere to strict protocols for immediately disabling accounts of departing employees to prevent unauthorized access.
• Apply Principle of Least Privilege: Limit access to sensitive records and systems to only what is absolutely necessary for an individual’s role. Regularly review and adjust access permissions.
• Enhance Monitoring and Alerting: Deploy robust monitoring systems capable of detecting unusual search volumes, bulk data downloads, or atypical access patterns, and configure alerts for immediate investigation.
• Regularly Audit Third-Party Access: Periodically review and re-evaluate the necessity and scope of access granted to third-party vendors and partners. Do not treat initial approval as a permanent security measure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.