Every country keeps a list of its people. Denmark just found out what happens when someone else gets to search that list.
What Actually Happened
Denmark’s list is called the CPR, short for Det Centrale Personregister. It holds one entry per person: name, address, date of birth, and the CPR number Danes use with the doctor, the bank and the tax office. Think of a social security number, except that it is used almost everywhere, every day.
On Monday, the government office that runs the register said unknown people had taken the names, addresses and CPR numbers of about 8.8 million people. The register holds roughly 11 million entries, because it also keeps records for people who moved abroad and for people who have died. Denmark itself has about six million residents.
Nobody broke down a door. Danish companies with a legitimate reason may ask the register to confirm details about people they are dealing with. Someone used one such company’s access to run an enormous number of look-ups and pull out record after record. The company’s access has been cut off, the police are investigating, and the data protection authority — the government body that enforces privacy law — has been told.
One group was left out: people who had asked for name and address protection were not part of the search. Everyone else in those 8.8 million records should assume their details are in someone else’s hands.
Why It Matters to You
The first question after a breach is whether someone can now log into your bank. Here the answer is mostly no, and that is worth saying. Denmark protects its most sensitive services with MitID, a second check on top of your password, so a CPR number alone cannot turn a stranger into you.
The real danger is quieter and more effective. A scammer who already knows your name, your address and your ID number sounds like an official. The details they read out are correct, because they came from a real register.
That is why the ministry’s own warning is about the phone call, not the computer: never hand over passwords or other confidential information when someone contacts you by phone, email or text — even when they clearly know your name, address and CPR number.
It is not only Denmark. Registers, banks and insurers everywhere hold the same kind of details. Your personal information cannot be the thing that keeps you safe, because it is not secret anywhere.
What You Can Do
The breach has already happened. What you control is what comes next.
- Hang up and call back. If a bank, a police officer or an office calls and asks you to do something, end the call and dial the number printed on your card or on that office’s own website.
- Treat knowing your details as no proof. A caller quoting your name, address or birthday has proved nothing — that information is exactly what a breach hands out.
- Never read out a code. The short number sent to your phone by text is a key, not a password. No real bank, police force or support desk needs you to say it out loud.
- Switch on the second step. In your bank, your email and your phone settings, turn on two-factor authentication — the extra check that a stolen password alone cannot pass.
- Read your statements. Check your bank and card statements, and any letters about credit. Noticing early is what limits the damage.
- In Germany, ask for an address block. Your local registration office (Meldeamt) can enter an Auskunftssperre free of charge, which stops your address being handed out on request. It runs for two years, and you need to show a reason, such as having been targeted before.
- Be wary of helpers. Anyone offering to check whether you were affected, or to claim compensation for you, usually wants your details or a fee.
What People Get Wrong
Myth: if they know my ID number, they can be me
A number on its own does not open your account. What it does is make a caller believable, and that is the part that costs people money. The ID number is the bait, not the key.
Myth: this is Denmark’s problem, not mine
The breach is Danish. The pattern is not. Registers, banks and insurers everywhere hold your name, address and date of birth, and something leaks somewhere most weeks.
Myth: there is nothing I can do about a breach
You cannot get the data back. You can still decide how much it costs you, by becoming the harder target: a second step on your logins, a sceptical ear on the phone, and a look at your statements.
What to Watch For Next
Expect more official-sounding contact in the coming weeks. The whole point of collecting names, addresses and ID numbers is to make the next call convincing.
Danish authorities have opened a digital security hotline and extended its hours. The police investigation is at an early stage, with no suspects named.
Watch for the second wave, too: messages offering to check whether your data was affected, or to help you claim money because of the leak. Those scams grow once the story reaches the news.
The One Thing to Remember
Your name, address and ID number are not secrets any more. Treat them as background information anyone might hold, not as proof that the person contacting you is real. What still protects you is the second step: the code you never read out, the app you confirm with, the call you end and make again yourself.
Image: “2018 – Christiansborg from the Marble Bridge” by Moahim, Wikimedia Commons, licence CC BY-SA 4.0.