Denmark’s Central Person Register (CPR) is notifying roughly 8.8 million people that their personal information was stolen in a data breach.
Established in 1968, CPR is Denmark’s national civil registration system and contains information on about 11 million people, including residents, emigrants, and deceased individuals.
On Monday, CPR announced that hackers used a Danish company’s lawful access to the system to exfiltrate people’s personal information.
Under Danish law, private companies with a legitimate interest gain access to the CPR to obtain information on specific individuals. Companies may also request the information under the country’s Data Protection Regulation and Data Protection Act.
The incident was discovered on Friday, when the population register was notified of abnormal behavior within its system during September.
Over the weekend, the organization determined that hackers accessed the names, addresses, and CPR numbers (the equivalent of Social Security numbers) of approximately 8.8 million registered individuals, both living and deceased.
The data breach does not affect individuals who chose to register with the name and address protection option, the national registrar says.