AN attacker reportedly abused a Danish company’s legitimate access to the country’s population register (CPR) to retrieve personal data for around 8.8 million people, including names, addresses and CPR numbers. The breach hinged on a leaked password linked to a former Pays ApS employee, an Odense-based IT company that provides CPR-related services such as data updates and CPR cleansing.
Pays has confirmed that its authorised access to search the CPR system was abused, enabling the attacker to perform an unusually large number of searches over a three‑week period before activity slowed and was shut down.
The CPR administration says the breach was discovered after an exceptionally large bill for about 14 million searches drew attention. Politiken reports put the data accessed at roughly 5.5 million living individuals and 3.3 million deceased, with access lasting 21 days before remediation.
The incident underscores how a weak password could grant an authorised route into a highly sensitive system, and highlights the need for stronger authentication, mandatory multi‑factor authentication for accessing sensitive data, and vigilant monitoring for unusual activity. The article notes steps organisations can take, including not reusing passwords, employing a password manager, enforcing strong authentication, and watching for anomalies that could signal misuse.