The National Register of Denmark was the subject of a cyberattack this Monday that resulted in the leakage of personal information of around 9 million people across the country, including their full names and postal addresses, as well as other sensitive data.
The Danish government has explained that the security breach originated after individuals still unidentified made "improper use" of the access credentials that a private Danish company had to the Central Register of Persons, known in the country as CPR. After detecting the incident, the authorities suspended the company's access to the database while a thorough investigation is conducted, according to the newspaper 'Berlingske'.
For now, government officials maintain that it is still premature to attribute the attack to a specific actor and have described what happened as "extremely serious." The Minister of Digitalization, Kristina Egelund, has indicated that a "thorough review of the security of the registration system" has been ordered and has urged the Danish population to "remain alert to suspicious phone calls and emails."
The CPR constitutes the basic infrastructure of the Danish public sector, characterized by a high degree of digitalization. Each resident has a unique 10-digit CPR number, widely used to identify individuals in their dealings with the Administration, banking entities, and healthcare services.
Although Denmark has a population of nearly 6 million inhabitants, the register's database stores information on about 11 million people, including those who have already passed away or moved abroad.
The authorities had detected irregular activity for the first time on October 2 and, after a subsequent analysis, concluded that unauthorized queries to the system had already occurred in September.