Denmark’s Central Person Register (CPR) is notifying roughly 8.8 million people that their personal information was stolen in a data breach.
Established in 1968, CPR is Denmark’s national civil registration system and contains information on about 11 million people, including residents, emigrants, and deceased individuals.
On Monday, CPR announced that hackers used a Danish company’s lawful access to the system to exfiltrate people’s personal information.
Under Danish law, private companies with a legitimate interest gain access to the CPR to obtain information on specific individuals. Companies may also request the information under the country’s Data Protection Regulation and Data Protection Act.
The incident was discovered on Friday, when the population register was notified of abnormal behavior within its system during September.
Over the weekend, the organization determined that hackers accessed the names, addresses, and CPR numbers (the equivalent of Social Security numbers) of approximately 8.8 million registered individuals, both living and deceased.
The data breach does not affect individuals who chose to register with the name and address protection option, the national registrar says.
After discovering the incident, CPR immediately terminated the private company’s access, notified the Danish Data Protection Agency, and launched an investigation with the police and other relevant authorities.
The population register urges individuals to be wary of unsolicited communication requesting personal information, passwords, and other sensitive data.
CPR said it would review its security policies and improve protections to prevent similar incidents. It also noted that it could not name the threat actor behind the data breach.
Related: 250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms
Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People
Related: DC Health Agency Exposes 400,000 Beneficiary Records
Related: 23 Million User Records Compromised in Gyazo Data Breach
