Experts urge Denmark to stop using CPR numbers for identity checks

Two experts say Denmark should stop using CPR numbers to verify people’s identities after 8.8 million numbers belonging to living and deceased Danes were stolen earlier this month. Two ministers are due to face questions about the data breach today, DR reports.

“We have to acknowledge that the CPR number is fundamentally compromised,” said Jacob Herbst, chair of the Cyber Security Council. He was backed by Jan Kaastrup, a digital investigator at cybersecurity company CSIS.

Kaastrup said the idea that a CPR number is a secret code people can use to authenticate themselves at a doctor’s office, pharmacy, when receiving a fine from DSB or when taking out a short-term loan must be abandoned. Authentication means checking that someone’s claimed identity is genuine, while identification means stating who you are.

The Danish Parliament’s Business and Digitalisation Committee has called Digitalisation Minister Christina Egelund and Minister for Societal Security and Preparedness Lisbeth Bech-Nielsen to a hearing. They will be asked, among other things, whether the leak means Denmark should rethink its digital infrastructure and use of the CPR system. The hearing is scheduled to begin at noon.

Herbst said CPR numbers have been left in a difficult position: they contain personal information, including date of birth and gender, but have also been compromised. The Cyber Security Council has proposed banning their use for authentication, with tools such as MitID and the new AltID used instead.

Herbst said CPR numbers should be used only to identify people, for example to distinguish between two people with the same name. Kaastrup said a redesigned system could give every resident in Denmark a unique number that does not contain sensitive personal information. He said people would still need an identifying number, while a separate tool should be used to authenticate them.