Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark's national population register, the country's digitalization ministry said on October 5.

They used a private Danish company's lawful right to look up records in the Central Person Register (CPR). The ministry has told people never to give passwords or other confidential information to anyone who calls or emails, even someone who seems to know those details.

The register's administration has stopped the company's access and reported the case to Datatilsynet, Denmark's data protection authority. Police are investigating.

A very large number of automated lookups were made in the register to identify valid personal identification numbers, known as CPR numbers, Datatilsynet said in a notice on October 5. Its account comes from the notification it received from the register a day earlier. It has not yet assessed the case and describes the numbers as allegedly retrieved.

The access lasted about 10 days in September and went through a small Danish company, according to Christina Egelund, the minister responsible for digitalization, who spoke to the news agency Ritzau. An employee of the register's administration noticed the unusual activity on Friday, October 2. Over the weekend, the administration learned how many people's records were involved.

The official statements leave three questions open: how the unauthorized parties gained access to the company's systems, whether they have retained or used the data, and who they are.

Source link