Denmark’s CPR breach: Securing third-party access to your API

Denmark’s September 2026 CPR breach involved the misuse of a private company’s legitimate access to the national civil register, resulting in roughly 14 million lookups and exposure of names, addresses, and CPR numbers for about 8.8 million people, or approximately 80% of the register. Authorities said no technical vulnerability in the CPR system was exploited because the requests used valid credentials and accessed data the company was ordinarily permitted to retrieve, but the volume far exceeded its stated customer base and was detected only during invoicing after the activity had stopped. Reports linked the access to Pays ApS and alleged that a former employee’s leaked password may have been used, though the precise method and responsible party remained under investigation. The incident illustrates that API authentication and endpoint permissions alone do not control whether a partner is querying an authorized population, at a justified scale, or for a documented purpose. Proposed safeguards include purpose-specific partner grants, predeclared subject populations, quotas based on legitimate business needs, anomaly alerts for unusual volume or failed-match rates, detailed egress audit logs, and named partner accounts protected by identity-provider controls and multifactor authentication. The breach also reinforced warnings that CPR numbers should not be treated as proof of identity, since they identify individuals but do not verify who possesses them.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.