Denmark data breach exposes 8.8M people's personal data
A security breach at Denmark's Central Person Register exposed personal data, including social security numbers and addresses, for roughly 8.8 million people via an abused corporate API.
summary is enough The official announcement is brief, but the comments offer sharp technical insight into the fragility of national ID systems.
summary
Denmark's Central Person Register experienced a severe security breach exposing personal details like social security numbers and addresses for approximately 8.8 million people. Attackers exploited the legitimate API access of a Danish company, forcing authorities to revoke permissions and launch police investigations. Commenters note the exposed total exceeds Denmark's population, encompassing former residents and foreign nationals, and highlight structural flaws in relying on national IDs for authentication.
key points
- A compromised corporate API allowed unauthorized access to personal data for roughly 8.8 million individuals in Denmark's Central Person Register.
- Exposed information includes social security numbers, physical addresses, and family relations, though protected addresses were reportedly excluded.
- Commenters emphasize that national ID numbers must be treated purely as usernames rather than secrets since leaks are inevitable.
who should read it
Software engineers, security professionals, and policy makers tracking digital identity infrastructure.
discussion skeptical
consensus
Commenters widely agree that national ID numbers are inherently unsecret and should only function as usernames paired with robust 2FA, while expressing frustration over chronic public-sector security lapses.
pushback
A few commenters suggest that transparent personal data registries, similar to models in other Nordic countries, are less harmful than people fear.
I see this as a good thing. It means that we'll (hopefully) get stricter security revolving around using these numbers. It'll no longer be enough just to yap out a 10 digit number to "verify" you are who you say you are. We already have a (albeit heavily critiqued) national 2FA system in place (MitID).
We'll have to start treating the CPR number as just a username, instead of a password. It should never have been "secret" in the first place.
It argues that the breach should force a permanent architectural shift toward treating government ID numbers as public usernames rather than secrets.
Generated by an LLM from the article and thread. Check the sources before relying on it.