A single compromised vendor account simply uncovered private data on 8.8 million folks, greater than Denmark’s total inhabitants, pulled from the nation’s nationwide identification register. The attacker says an AI mannequin wrote this system that did it, and a primary coding bug by accident spared a complete start yr from publicity.
What Occurred
Danish authorities disclosed on October 5 that hackers abused a non-public firm’s professional entry to the Central Individual Register, or CPR, the database that assigns each resident, deceased individual, and emigrant a singular identification quantity. The breach uncovered names, addresses, and CPR numbers tied to roughly 8.75 million data, in line with figures the attacker offered to Danish newspaper Politiken. That complete consists of about 5.5 million residing folks and three.3 million deceased ones, out of the roughly 11 million data the CPR holds. Denmark’s precise inhabitants is about 6 million.
The compromised account belonged to Pays ApS, a small Odense-based information companies agency that helps enterprise clients confirm addresses, deaths, and relocations by means of CPR lookups. Managing director Sophie Laursen confirmed on October 9 that an exterior social gathering had misused the corporate’s approved entry. Between September 10 and September 20, the intruder ran roughly 14 million automated searches, 8.75 million of which returned usable data. No person caught it in actual time. A ministry staffer found the breach on October 2 after noticing an unusually massive bill tied to Pays’s search quantity, 12 days after the exercise had already stopped.
Politiken later reported that at the very least three Pays accounts, together with an administrator account, used the password “123456.” Individually, an individual claiming duty informed the paper, by means of an encrypted chat carried out in English, that they bought in utilizing a leaked password belonging to a former Pays worker. Danish authorities have confirmed neither account of how the attacker bought in, nor the attacker’s identification. Digitalization Minister Christina Egelund known as the incident “extraordinarily critical” and ordered a evaluate of the CPR system’s safety controls. Datatilsynet, Denmark’s information safety authority, and the Nationwide Particular Crime Unit are each investigating.
The attacker additionally informed Politiken that synthetic intelligence wrote the extraction program, a script greater than 40,000 characters lengthy, saying “any AI mannequin launched inside the previous yr or so would be capable of do it.” Two specialists who reviewed the code for Politiken agreed it appeared AI-generated. The clearest proof: a bug despatched this system looking for folks born in 1877 as a substitute of 1977, so the leaked dataset is lacking a complete start yr by chance.
Why It Issues
Not one of the attacker’s claims, in regards to the password, the AI tooling, or the said intent to not promote the information, have been independently verified by Danish authorities. However the sample beneath them is acquainted. CPR numbers perform in Denmark the way in which Social Safety numbers perform in the USA: as each a common identifier and, in apply, a stand-in for proof of identification. Banks, employers, hospitals, and landlords all request it. As soon as a quantity like that leaks at inhabitants scale, treating it as a secret stops making sense, as a result of tens of hundreds of thousands of different events already maintain it too. Danish cybersecurity specialist Jan Kaastrup informed broadcaster TV 2 that the CPR quantity’s function as an implicit secret is now merely “damaged.”
That can be why the invention methodology issues as a lot because the breach itself. Fourteen million automated queries ran over ten days by means of one vendor account, and nothing within the CPR system’s monitoring flagged it as irregular. An bill surfaced the intrusion, not a safety alert. The sample echoes different 2026 incidents, together with the Thomson Reuters court-records publicity and a string of vendor-credential breaches throughout healthcare and regulation corporations, the place the attacker broke nothing technical. They merely used entry that was already there.
The AI element is the half producing headlines, and it deserves scrutiny relatively than alarm. A 40,000-character script that enumerates sequential ID numbers and pulls matching data isn’t a classy exploit. What AI help plausibly did was compress the time and ability wanted to jot down that script from days to minutes, not invent a brand new assault methodology. The century bug, mistaking 1977 for 1877, is a two-digit-year error that has dogged software program since lengthy earlier than massive language fashions existed, apparently inherited now by the instruments that write software program at this time.
Our Take: Our take is that the password and the AI element are the least necessary details on this story, although they’re probably the most quotable. The actual failure is structural: a authorities handed broad, standing search entry to a small vendor with no obvious restrict on question quantity, no real-time anomaly detection, and no requirement for multi-factor safety on an account that might enumerate a complete nation’s inhabitants. Fixing the password wouldn’t have mounted that. Denmark’s recommendation to lean on MitID and one-time codes as a substitute of the CPR quantity is the proper transfer, however additionally it is an admission that the quantity itself is now completely compromised for roughly 8.8 million folks.
Anticipate extra governments to face this identical reckoning as AI tooling retains decreasing the price of mass-scale enumeration assaults towards databases constructed round a single, static identifier. The establishments that get forward of it will likely be those that cease treating identification numbers as secrets and techniques and begin treating vendor entry itself because the perimeter price watching.
A single compromised vendor account simply uncovered private data on 8.8 million folks, greater than Denmark’s total inhabitants, pulled from the nation’s nationwide identification register. The attacker says an AI mannequin wrote this system that did it, and a primary coding bug by accident spared a complete start yr from publicity.
What Occurred
Danish authorities disclosed on October 5 that hackers abused a non-public firm’s professional entry to the Central Individual Register, or CPR, the database that assigns each resident, deceased individual, and emigrant a singular identification quantity. The breach uncovered names, addresses, and CPR numbers tied to roughly 8.75 million data, in line with figures the attacker offered to Danish newspaper Politiken. That complete consists of about 5.5 million residing folks and three.3 million deceased ones, out of the roughly 11 million data the CPR holds. Denmark’s precise inhabitants is about 6 million.
The compromised account belonged to Pays ApS, a small Odense-based information companies agency that helps enterprise clients confirm addresses, deaths, and relocations by means of CPR lookups. Managing director Sophie Laursen confirmed on October 9 that an exterior social gathering had misused the corporate’s approved entry. Between September 10 and September 20, the intruder ran roughly 14 million automated searches, 8.75 million of which returned usable data. No person caught it in actual time. A ministry staffer found the breach on October 2 after noticing an unusually massive bill tied to Pays’s search quantity, 12 days after the exercise had already stopped.
Politiken later reported that at the very least three Pays accounts, together with an administrator account, used the password “123456.” Individually, an individual claiming duty informed the paper, by means of an encrypted chat carried out in English, that they bought in utilizing a leaked password belonging to a former Pays worker. Danish authorities have confirmed neither account of how the attacker bought in, nor the attacker’s identification. Digitalization Minister Christina Egelund known as the incident “extraordinarily critical” and ordered a evaluate of the CPR system’s safety controls. Datatilsynet, Denmark’s information safety authority, and the Nationwide Particular Crime Unit are each investigating.
The attacker additionally informed Politiken that synthetic intelligence wrote the extraction program, a script greater than 40,000 characters lengthy, saying “any AI mannequin launched inside the previous yr or so would be capable of do it.” Two specialists who reviewed the code for Politiken agreed it appeared AI-generated. The clearest proof: a bug despatched this system looking for folks born in 1877 as a substitute of 1977, so the leaked dataset is lacking a complete start yr by chance.
Why It Issues
Not one of the attacker’s claims, in regards to the password, the AI tooling, or the said intent to not promote the information, have been independently verified by Danish authorities. However the sample beneath them is acquainted. CPR numbers perform in Denmark the way in which Social Safety numbers perform in the USA: as each a common identifier and, in apply, a stand-in for proof of identification. Banks, employers, hospitals, and landlords all request it. As soon as a quantity like that leaks at inhabitants scale, treating it as a secret stops making sense, as a result of tens of hundreds of thousands of different events already maintain it too. Danish cybersecurity specialist Jan Kaastrup informed broadcaster TV 2 that the CPR quantity’s function as an implicit secret is now merely “damaged.”
That can be why the invention methodology issues as a lot because the breach itself. Fourteen million automated queries ran over ten days by means of one vendor account, and nothing within the CPR system’s monitoring flagged it as irregular. An bill surfaced the intrusion, not a safety alert. The sample echoes different 2026 incidents, together with the Thomson Reuters court-records publicity and a string of vendor-credential breaches throughout healthcare and regulation corporations, the place the attacker broke nothing technical. They merely used entry that was already there.
The AI element is the half producing headlines, and it deserves scrutiny relatively than alarm. A 40,000-character script that enumerates sequential ID numbers and pulls matching data isn’t a classy exploit. What AI help plausibly did was compress the time and ability wanted to jot down that script from days to minutes, not invent a brand new assault methodology. The century bug, mistaking 1977 for 1877, is a two-digit-year error that has dogged software program since lengthy earlier than massive language fashions existed, apparently inherited now by the instruments that write software program at this time.
Our Take: Our take is that the password and the AI element are the least necessary details on this story, although they’re probably the most quotable. The actual failure is structural: a authorities handed broad, standing search entry to a small vendor with no obvious restrict on question quantity, no real-time anomaly detection, and no requirement for multi-factor safety on an account that might enumerate a complete nation’s inhabitants. Fixing the password wouldn’t have mounted that. Denmark’s recommendation to lean on MitID and one-time codes as a substitute of the CPR quantity is the proper transfer, however additionally it is an admission that the quantity itself is now completely compromised for roughly 8.8 million folks.
Anticipate extra governments to face this identical reckoning as AI tooling retains decreasing the price of mass-scale enumeration assaults towards databases constructed round a single, static identifier. The establishments that get forward of it will likely be those that cease treating identification numbers as secrets and techniques and begin treating vendor entry itself because the perimeter price watching.
