Data breach revives calls to replace Denmark’s 58-year-old CPR system

Unauthorised access to the personal numbers, names and addresses of 8.8 million people has renewed calls to rethink Denmark’s 58-year-old CPR system, DR reports.

The access lasted 10 days and was obtained by misusing a Danish company’s legitimate access to the system. The CPR administration became aware of irregular activity on the evening of Friday, October 2, and learned over the weekend that data belonging to registered people had been accessed. The records included those of people who are living, have emigrated or are deceased.

Authorities have not identified the company involved or explained how the access was carried out.

Digital investigator Jan Kaastrup, of cybersecurity company CSIS, said several features of the system should be replaced. People cannot get a new CPR number if theirs is leaked, he said, comparing it to having a lifelong password that works across many systems. He also said it could be possible to guess someone’s number from a pool of just over 200 possibilities.

Henning Mortensen, chair of the Council for Digital Security, said CPR numbers were intended to serve as reference numbers, not as proof of identity. He said people should use a passport, driving licence or MitID to verify who they are.

Mortensen said the council had made similar warnings 13 years ago. He wants gender and date-of-birth information removed from CPR numbers, and has proposed using anonymous numbers that could be made public to show they are not a means of authentication.

Digitalisation Minister Christina Egelund has not promised to abolish the system. She said the breach raised questions about whether the CPR register should be organised differently and that she had requested a comprehensive security assessment. She has described the system as a “fundamental building block” of Denmark’s digital infrastructure.

In 2013, then economy and interior minister Margrethe Vestager said the country would miss the CPR system if it were scrapped.