Denmark national population register (CPR) data taken through IT firm Pays ApS

Denmark's digitalization ministry confirmed on October 5 that unauthorized actors abused a private firm's lawful lookup access to the Central Person Register and obtained names, addresses and CPR numbers for about 8.8 million registered people (living, deceased and emigrated). Pays ApS, a two-employee Odense firm with authorized CPR access, confirmed on October 9 that its access was the one abused. Access was cut off and the case was reported to the Danish Data Protection Agency and police.

Sources: Cybernews; eSecurity Planet; CSO Online