Third-Party Access Exploited to Breach Denmark's Entire Population Registry
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors abused a private company's legitimate access to Denmark's Central Population Register (CPR) to enumerate and exfiltrate personal data on 8.8 million individuals using CPR number brute-forcing. The root cause is a failure to enforce granular, least-privilege access controls on a highly sensitive national database, combined with the absence of anomaly detection to flag bulk enumeration attempts. Allowing a third-party vendor unrestricted or overly broad query access to a national registry without rate limiting or behavioral monitoring created a catastrophic single point of failure. This breach matters because CPR numbers are permanent national identifiers used across Danish society — unlike passwords, they cannot be reset — making the long-term identity fraud risk severe and irreversible.
Tactical Insight
Immediate actions
- Revoke or suspend all third-party access to the CPR registry pending a full access rights audit and re-authorization review.
- Implement strict API rate limiting and query thresholds to prevent bulk enumeration of national identifier numbers.
- Notify all 8.8 million affected individuals and engage national identity fraud monitoring services immediately.
Long-term improvements
- Enforce least-privilege access for all third-party integrations, restricting vendors to only the specific records and fields required for their business function.
- Mandate formal third-party risk assessments and contractual security obligations before granting any access to sensitive government registries.
- Replace direct registry access with tokenized or privacy-preserving lookup APIs that never expose raw CPR numbers in bulk.
Detection measures
- Deploy behavioral analytics and SIEM alerting to detect abnormal query volumes, sequential ID lookups, or off-hours data access patterns.
- Establish a continuous audit log review process for all third-party access sessions to critical national data stores.
- Conduct regular penetration testing specifically targeting enumeration and brute-force attack vectors against registry APIs.