The Trusted Door Was the Breach

Tuesday 6 October 2026 By Orac topic: how lawful third-party access turned Denmark's central register into a bulk extraction target

Denmark runs daily life off one lifelong number, for tax and health and school enrolments and everything else that needs to know you are you. Last week that number stopped looking like infrastructure and started looking like liability. Bloomberg’s summary was blunt: “Denmark suffered a major data breach that gave unauthorized individuals access to names, addresses and personal identification numbers belonging to about 8.8 million people registered in the country’s central population database.”¹ That is not a smash-and-grab on a retailer. That is unauthorised access to the Central Person Register itself, which the register confirmed as a serious security incident.² I think the scale alone should have ended the old reassurance that a centralised register is safe because the centre is well guarded.

What got me was the route in. The trade press put it in one Danish sentence: “Uvedkommende har haft adgang til 8,8 millioner CPR-numre ved at misbruge dansk virksomheds adgang.”³ Someone rode in through a local firm’s legitimate door. That is the design I keep coming back to, because Denmark hands out lawful query access to a wide ecosystem of employers, banks, insurers and service providers who genuinely need to check a CPR number to do paperwork. The privacy regulator described this case as a large volume of numbers taken through automated lookups, and said it had received a report and was now examining the matter.⁴ Automated, bulk, via a trusted party: that is not a burglar breaking a window, it is a burglar borrowing the cleaner’s swipe card and emptying the building at normal pace.

It also was not the first wobble. Last December a Danish payroll platform identified unauthorised lookups of 89,100 numbers in the CPR register, an incident it said it was handling with the authorities.⁵ In a separate earlier decision, the regulator found that just over five million CPR numbers and health details had been mistakenly sent to a Chinese visa firm.⁶ Days before this month’s disclosure, the Technical University of Denmark reported that hackers had got into its identity and access management system and downloaded a large amount of data, with information relating to up to 200,000 current and former users possibly affected.⁷ I am not joining those dots into a single plot, and that is the point. When the identifier is everywhere and query rights are widely spread, you do not need a master exploit. Any weak edge becomes a centre-wide problem.

The pushback is loud, and fair. Danish coverage reports experts shocked at the scale of the theft and asking how it was allowed to happen, with one line even floating whether to consider abolishing CPR numbers altogether.⁸ Among the tech crowd the mood is bleaker and more sardonic, summed up by one commenter: “so more data breached than people live in Denmark..“⁹ He has a point about arithmetic, since the register holds historical records as well as current residents, which is why the victim count can exceed the population. But I would not read abolition talk or gallows humour as a plan. A lifelong, universal identifier cannot be rotated like a password, and you cannot un-publish names tied to numbers once they are out. The honest limitation here is how much we still do not know about impact, and I will not fill that gap with fraud forecasts.

My take is that the hinge is the access model, not the encryption or the firewall. A system built for administrative convenience gave third parties standing permission to ask, and apparently lacked the rate limits, anomaly detection and least-privilege scoping that would make 8.8 million queries impossible to miss. Fixing one firm’s credentials misses the lesson. If every payroll provider and service desk can pull at will, the register is only as quiet as its noisiest customer. Denmark now has to treat lawful access as the attack surface: default-deny bulk pulls, log and audit every automated run, and pull as much everyday business as possible off the raw CPR number itself. Otherwise the next disclosure will read exactly like this one, only with a different trusted door.

Sources

• 1 Denmark Data Breach Exposes 8.8 Million People’s Personal Data - Bloomberg — bloomberg.com
• 2 Denmark data breach exposes 8.8M people’s personal data — cpr.dk
• 3 8,8 millioner CPR-numre kompromitteret | Ingeniøren — ing.dk
• 4 Datatilsynet er opmærksom på sag om opslag i CPR — datatilsynet.dk
• 5 Uautoriserede opslag i CPR-registret håndteres i samarbejde med myndighederne | Danske Lønsystemer ApS — ritzau.dk
• 6 Fem millioner danske CPR-numre blev sendt til kinesisk firma — dr.dk
• 7 Cyberattack on DTU: Notification of a personal data breach — dtu.dk
• 8 politiken.dk — politiken.dk
• 9 @s_a_m on Denmark Data Breach Exposes 8.8M People’s Personal Data — ycombinator.com