ENKR

Danish CPR register data breach via a company's lookup access

Add to my breach check

Made public · 8,800,000 people registered in the CPR

What leaked3

Hard to replace

  • Home or delivery address

Permanent

  • National ID number with the birth date in it
  • Full name
  • National ID number with the birth date in itCPR number · Danish personal identification number; its first six digits are the date of birth
  • Home or delivery addressnot for people registered with name and address protection
  • Full namenot for people registered with name and address protection

To-dos

None of the harms this check covers.

What happened next9 events

  1. Undetected 2 events22 days · show events
  2. Response 5 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 2 eventsUnder investigation · Back to latest
  5. DisputesNone on record

Penalty: 2 events

Back to latest
  1. Authorities and companies urged not to rely on CPR number, name or address alone to verify identity
  2. Datatilsynet took up the case, including who is responsible for the processing
Company
Danish Civil Registration System
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
8,800,000 people registered in the CPR · approx.; living, emigrated, deceased and others; ministry figure

How the facts developed

  1. The ministry announced that unauthorised persons had misused a Danish company's lawful CPR lookup access to obtain names, addresses and CPR numbers of about 8.8 million registered people; access ran from 10 to 20 September (press)

Sources