Hackers have accessed the personal information of about 8.8 million people in Denmark after breaching a company that had legitimate access to the country’s national population registry.
The Danish Ministry of Digital Affairs disclosed the breach on Monday, saying the compromised information included names, addresses and CPR numbers, the equivalent of social security numbers.
The figure is significantly higher than Denmark’s population of about six million because the national registry holds records of around 11 million people, including those who have died or emigrated.
The ministry said the attackers did not directly breach the registry’s core systems but gained access through a Danish company that was legally authorised to use the database.
It added that the company’s access to the registry had not been revoked despite the discovery of the breach.
Digital Affairs Minister Christina Egelund described the incident as “extremely serious”, saying authorities were working to establish the full extent of the exposure.
“Together with all the relevant authorities, we are in the process of mapping out the full extent of the incident,” she said.
An investigation has been launched, but authorities have yet to identify those responsible for the breach.
The incident has raised concerns about the security of government-held personal data and the risks associated with third parties having legitimate access to sensitive public databases.
The Danish authorities said the investigation would determine how the unauthorised access occurred and assess the information obtained by the attackers.
Discussion0