What Happened
Denmark’s Central Population Register suffered a breach affecting about 8.8 million people, roughly 80 percent of its 11 million records. BleepingComputer reports attackers did not break into the registry directly. They misused the legitimate access of a private company and enumerated CPR identification numbers by brute force.
The exposed data includes names, addresses, CPR numbers, birth dates, and marital status. Residents, expatriates, and deceased persons are all affected. Registry administrators discovered the breach on October 2 and announced it on October 5. Police are investigating, the company’s access is blocked, and Denmark opened a dedicated cyber hotline for affected people.
Why This Matters for Canadian Organizations
The attack path matters more than the headline number. The registry itself held up. The weak point was a trusted third party with approved access. Attackers took over the trust and used it at scale.
Canada has no single national population register, but Canadian organizations hold equivalent identifiers. Social Insurance Numbers, provincial health card numbers, and driver’s licence data feed credit bureaus, background check firms, insurers, and payroll providers. Each connection to a government database or a shared data service is a path attackers will test.
Canadian privacy law places responsibility on the organization, not only the vendor. PIPEDA holds you accountable for personal information handled by service providers, and Quebec’s Law 25 adds breach reporting duties with penalties. If a contractor with query access to sensitive records is compromised, regulators will ask what limits you set.
What to Do
List every third party with query access to identity data. Enforce per-account rate limits and alert on sequential or high-volume lookups. Require multi-factor authentication and IP allowlisting for API credentials. Review contract terms for breach notification timing. Read more in our Trends coverage and our Legislation section.
