Unauthorized parties obtained the names, addresses and CPR numbers of about 8.8 million people from Denmark’s Central Person Register by abusing a private company’s legal access to the system, the Danish government has disclosed. Authorities are now telling businesses and public bodies to stop treating a CPR number as proof of identity.
The CPR is Denmark’s national civil registration system, and the CPR number is the country’s personal identification number. The register holds records on about 11 million people, including current residents, people who have moved abroad and the deceased. Some organizations have used a name, address and CPR number to confirm the identity of people contacting them. The government’s AltID app, which offers a digital legitimation card and a separate age proof, is available to anyone over 13 with MitID and a CPR number.
According to the Ministry of Research, Education and Digitalisation, the unauthorized access took place during September through a Danish company permitted to search the register under the CPR Act. The CPR administration noticed irregular activity on the evening of Friday, October 2, has blocked the company’s access and has reported the incident to Datatilsynet, the Danish Data Protection Agency. Police are investigating. Names and addresses of people registered with name and address protection were not exposed.
“It is a deeply serious incident,” said Christina Egelund, minister for research, education and digitalisation, who has ordered a thorough security review of the CPR system and briefed the Folketing’s business and digitalisation committee.
Guidance for organizations on Sikkerdigital.dk, the digital security site that Samsik and the ministry direct people to, says that for requests such as access to personal information, changes to contact details, new subscriptions, credit purchases, new SIM cards, password resets or changes to payment details, a CPR number, name, address or date of birth should not be sufficient. Suggested alternatives include sending the person to a self-service login with MitID, the national digital identity system, sending a one-time code to contact details already on file, calling back on a registered number, and asking the person to appear with identification for significant financial or security-related changes.
“One must expect that one can no longer identify oneself with CPR,” said Laila Reenberg, director of the Danish Agency for Public Security, known as Samsik. Danish pharmacies have begun asking customers collecting prescriptions for a physical or digital health card or verification questions, and the Danish Association of General Practitioners has asked its members to follow Samsik’s recommendations.
Sources: Ministry of Research, Education and Digitalisation, Sikkerdigital.dk, The Copenhagen Post
–
By the ID Tech Editorial Team
