[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCNN8_G7VQUIBDE2yE8FHtrlhTfACh5VV1lJzQnHdm8o":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":43,"created_at":44,"published_at":45,"article":46,"tags":50,"podcasts":69,"controls":70},"5baf2add-ac2e-4239-9d8d-c15a8ef1c6e7","third-party-access-abuse-exposes-88-million-danish-citizens-personal-data","49f7c477-5fbf-46ac-9f05-c174a640869e","Third-Party Access Abuse Exposes 8.8 Million Danish Citizens' Personal Data","The breach at Denmark's Central Person Register (CPR) stemmed from attackers exploiting a legitimate third-party company's authorized access to the system — a classic supply chain and access control failure. Once inside, the attackers were able to exfiltrate sensitive personal information including names, addresses, and national identity numbers for nearly the entire Danish population. The breach was only detected when abnormal system activity was observed, highlighting insufficient real-time monitoring of privileged third-party sessions. This incident underscores how trusted external access, without adequate controls and behavioral monitoring, can become one of the most dangerous attack vectors against critical government infrastructure.","**Immediate actions:**\n- Audit and revoke all unnecessary third-party access to sensitive government systems immediately.\n- Implement behavioral anomaly detection to flag unusual data access volumes or patterns from any account, including trusted partners.\n- Notify affected individuals and regulatory authorities promptly in line with applicable data protection laws.\n\n**Long-term improvements:**\n- Enforce the principle of least privilege for all third-party integrations, restricting access to only the minimum data and functions required.\n- Require third-party vendors to undergo regular security assessments and comply with contractual security standards before granting system access.\n- Implement Just-In-Time (JIT) access provisioning for external partners so access is granted only when needed and automatically expires.\n\n**Detection measures:**\n- Deploy a SIEM solution with dedicated rules to detect bulk data queries or exports from accounts with elevated access to citizen records.\n- Establish continuous session logging and recording for all third-party access to critical national infrastructure systems.\n- Define and baseline normal access patterns for each third-party integration to enable faster anomaly detection.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 15: Service Provider Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST AU-6: Audit Record Review and Reporting","NIST SI-4: System Monitoring","NIST SR-6: Supplier Assessments and Reviews","GDPR Article 5: Principles of Data Processing","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of Personal Data Breach","ISO\u002FIEC 27001 A.9.2: User Access Management","ISO\u002FIEC 27001 A.15.1: Information Security in Supplier Relationships","ITIL: Access Management Process",{"NIST AC-6: Least Privilege":28,"NIST SI-4: System Monitoring":29,"NIST AC-2: Account Management":30,"ITIL: Access Management Process":31,"CIS Control 5: Account Management":32,"CIS Control 8: Audit Log Management":33,"GDPR Article 32: Security of Processing":34,"CIS Control 6: Access Control Management":35,"CIS Control 15: Service Provider Management":36,"ISO\u002FIEC 27001 A.9.2: User Access Management":37,"NIST SR-6: Supplier Assessments and Reviews":38,"NIST AU-6: Audit Record Review and Reporting":39,"GDPR Article 5: Principles of Data Processing":40,"GDPR Article 33: Notification of Personal Data Breach":41,"ISO\u002FIEC 27001 A.15.1: Information Security in Supplier Relationships":42},"Least privilege limits third parties to the CPR data they genuinely need.","System monitoring helps detect exfiltration of large volumes of citizen data.","Account management ensures third-party accounts are monitored and disabled when misused.","Access management processes govern how third parties receive and lose access to sensitive systems.","Account management for third-party users ensures their access to the CPR is reviewed and limited.","Audit logs of CPR queries would help detect bulk extraction through the third party's account.","Security of processing requires appropriate measures for national register data, including third-party access controls.","Access control management limits what a third party's authorised access can retrieve from the population register.","Service provider management includes vetting and monitoring third parties with access to sensitive registers.","User access management ensures third-party access is provisioned and reviewed appropriately.","Supplier assessments verify that third parties with CPR access protect their credentials and systems.","Reviewing audit records helps detect abnormal access patterns, such as mass lookups of citizens.","Data processing principles include integrity and confidentiality, which the CPR breach violated.","A breach affecting 8.8 million citizens triggers notification duties to the supervisory authority.","Supplier relationship security includes setting access and security requirements for third parties using the CPR.","published","2026-10-06T10:20:35.401102+00:00","2026-10-06T10:20:35.284+00:00",{"id":7,"url":47,"slug":48,"title":49},"https:\u002F\u002Fwww.securityweek.com\u002F8-8-million-impacted-by-data-breach-at-denmarks-central-person-register\u002F","8-8-million-impacted-by-data-breach-at-denmark-s-central-person-register-2c43ce","8.8 Million Impacted by Data Breach at Denmark’s Central Person Register",[51,57,63],{"id":52,"name":53,"slug":54,"description":55,"color":56},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":58,"name":59,"slug":60,"description":61,"color":62},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":64,"name":65,"slug":66,"description":67,"color":68},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[71,75,79],{"slug":72,"name":73,"problem":74},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":76,"name":77,"problem":78},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":80,"name":81,"problem":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]