Expensive invoice exposed unauthorised access to Denmark’s CPR data

An unusually large bill to a small Danish company led authorities to discover that unauthorised users had accessed CPR data on 8.8 million people in Denmark over about 10 days in September, DR reported.

Authorities said at a press conference on Tuesday that they do not yet know who was responsible or what the data was intended for. The company had lawful access to the CPR register, where each search incurs a fee. A large charge alerted officials to the unusually high level of activity.

Henriette Erbs, a department head at the National Special Crime Unit, said it was too early to identify those behind the access or establish how it was carried out. She added that cases of this kind often involve cross-border crime.

Laila Reenberg, director of the Agency for Societal Security, said authorities were taking the case very seriously. She said digital fraud was an obvious possibility, but that the purpose of the data collection remained unknown.

The data accessed primarily concerned people’s names and addresses, said Mikkel Leihardt, a department head at the Ministry of Research, Education and Digitalisation.