A Two-Person Vendor’s Login Reached 8.8 Million Danish Records. A Bill Caught It.

Estimated reading time: 9 minutes

An attacker used a two-person firm’s legitimate access to Denmark’s ID register. It pulled names, addresses, and ID numbers on about 8.8 million people. An unusually large bill raised the alarm. I asked Raj Ananthanpillai, CEO of identity company Trua, who failed and who should pay.

Denmark’s Central Person Register, known as CPR, gives every resident a personal ID number. Danes use it for banking, health care, tax, and most dealings with the state.

Private companies with a legitimate need can buy lookups under Section 38 of the CPR Act. The ministry’s terms limit them to people they have identified in advance. More than 1,000 companies hold that access. Pays ApS, a two-person IT firm in Odense, was one of them. It sells a service called CPR-vask, which updates companies’ customer lists with data drawn straight from the register.

An attacker held Pays’ access for 21 days and 17 hours from Sept. 10, The Copenhagen Post reported. The lookups ran over about ten days. The account made well over 14 million lookup attempts, The Next Web reported, citing TV 2. About 8.8 million of them returned a name, address and CPR number.

That total exceeds Denmark’s population of about 6 million. The register also keeps records on people who have died or moved abroad. People with name and address protection were not reached, the ministry said.

How The Denmark CPR Breach Came To Light

Billing exposed the breach. The CPR office charges companies for each lookup. Officials spotted the activity while invoicing Pays on the evening of Oct. 2.

“There is a very large amount being invoiced,” ministry official Mikkel Leihardt told a press briefing, TV 2 Østjylland reported.

Police from the National Unit for Special Crime secured evidence at the company the next evening. The CPR office cut off Pays and reported the case to Denmark’s data protection agency. Denmark’s digital affairs ministry announced the breach Oct. 5.

Pays confirmed to TV 2 by email that it was the company, TV 2 Fyn reported. Its “legal access to search for information in the CPR system has been abused,” owner Sophie Laursen wrote. “We take the episode very seriously,” she added. She said Pays has worked closely with the ministry, police and Denmark’s data protection agency.

Politiken found at least three Pays accounts used the password “123456.” One was the administrator account. A person claiming responsibility told Politiken the first way in was a former employee’s leaked password. The password details have not been officially confirmed. Public reporting has not said whether the accounts used multi-factor authentication.

Laursen has not addressed the password reports. She did not return TV 2 Fyn’s calls. She had not answered Politiken’s questions on security as of Oct. 13.

The same person said an AI model wrote the extraction program. Two experts hired by Politiken judged the code AI-generated, TV 2 Fyn reported.

Christina Egelund, the minister responsible, said security around the register “has not been good enough.” She ordered a security review of the CPR system.

Who Failed In The Denmark CPR Breach

I put that question to Ananthanpillai. Trua sells identity verification and background screening. He split the blame.

“Both sides failed,” he said in written answers to my questions. “Pays used weak passwords, including ‘123456’ on at least one administrator account, left a former employee’s login active, and apparently had no multi-factor authentication on a system that could pull national population data. That should never have been acceptable.”

“At the same time, the CPR office gave a two-person company broad search rights and then relied on the monthly invoice as the main way to notice something was wrong,” he said. “Fourteen million lookups is far outside normal use for a firm of that size. Nothing stopped it until the bill arrived.”

On paper, the rights were narrow. The ministry’s terms limit a company to people it has identified in advance. The system still returned 8.8 million records to one small account.

“The vendor opened the door through poor controls,” Ananthanpillai said. “The register failed to watch what that approved access was actually doing.”

New CPR Register Rules Reach 1,039 Companies, Insurers Included

On Oct. 9, the CPR office wrote to the 1,039 companies with access, Kristeligt Dagblad reported. Each must now name a security officer. Each must check staff access to register data regularly. And each must track its monthly lookup count to spot misuse.

The recipients include financial firms, telecoms, law firms, trade unions and insurers.

Denmark’s civil protection agency went further. It told companies and authorities to stop accepting a CPR number alone as proof of identity. Its director, Laila Reenberg, called digital fraud an obvious possible use for the data.

That puts insurers on both sides of the breach. They hold CPR access. The new rules reach them. They also verify customers. A CPR number alone should no longer count for that, the agency says.

Fraudsters can pair real names and numbers with forged documents. Shufti projects document deepfakes will rise about 40-fold this year.

Does One Register Reduce Third-Party Vendor Risk?

Ananthanpillai argues that storing personal data in fewer places cuts risk more than adding security layers. Denmark keeps its population data in one register. One weak access route still reached 8.8 million records. I asked him how he squares the two.

“This does not undercut the argument,” he said. “A single national register is not automatically the problem. The problem was giving a small vendor wide, live search access and then not watching how it was used.”

“That is still better than the usual pattern, where the same data is copied into dozens of private systems, each with leftover accounts, weak passwords, or connections no one is monitoring,” he said. “One place that is tightly limited and actively watched carries less risk than the same information sitting in a hundred companies that never needed to hold it.”

Trua’s business rests on that model. It issues credentials that confirm facts about a person without passing on the underlying records.

The trade-off is concentration. One store makes one target. Its controls have to hold every time.

What To Ask Before Granting Third-Party Vendor Access

Denmark’s breach ran through a vendor’s login to reach data the vendor did not own. Kroll sees that pattern often. The firm sells breach response and notification services.

Denyl Green heads breach notification at Kroll. In most major incidents Kroll handled over the past year, “a vendor, software supplier or service provider was the link,” Green said in a statement last week.

Ananthanpillai’s checklist starts before any login is issued. “Before granting access, require unique strong credentials, mandatory multi-factor authentication, confirmation that accounts are not shared, a clear list of every person who will use the login, and proof that former employees are removed the day they leave,” he said.

“Ask how the contractor will spot unusual volume or patterns on its side. Limit the rights to the minimum needed for the stated purpose and make them time limited.”

He wants the checks repeated. “Then run those same checks at least every few months, and immediately when someone leaves, a role changes, or activity spikes,” he said. “A yearly form is not enough when the data covers millions of people.”

Cyber insurance applications already ask insureds about MFA. A recent CCPL paper argues insurers should now ask which kind.

Small suppliers can slip past that scrutiny. Graylog CMO Kimber Spradlin made the point on a recent CINI podcast. Marketing teams often buy cheap plugins and form builders on expenses, she said. Those purchases can skip full procurement.

Vendor Cyber Insurance: Who Pays When A Two-Person Firm Is Breached

A two-person firm cannot absorb a loss on Denmark’s scale. An indemnity from a firm that size is worth only what it can pay.

“Any vendor with this level of access should be required to carry meaningful cyber insurance, or the access should not be granted,” Ananthanpillai said. “For a two-person firm, the premiums are often too high relative to revenue, so many of them cannot afford it.”

In that case, he said, the organization granting access has two choices. It can restrict the rights so tightly that a breach cannot reach millions of records. It can also accept that it carries the remaining risk.

“When neither the small vendor nor the granting authority has prepared for the cost, the people whose data was taken, and the public systems that have to respond, end up paying,” he said.

How Trua Says It Avoids Becoming The Weak Link

Trua handles the same kind of data. I asked how it avoids becoming someone else’s weak link.

Ananthanpillai said Trua keeps no store of raw personal data that partners or staff can query and export. It tokenizes the underlying information and holds it on a permissioned blockchain, he said. An organization checking a person gets a signed confirmation of only the facts it requested. It does not receive the underlying documents or identifiers.

“The design is meant to ensure that a compromised partner credential or internal access path cannot produce a bulk dump of readable personal information the way the Danish company’s CPR access did,” he said.

Those are Trua’s descriptions of its own design. Cyber Insurance News has not tested them. Ananthanpillai added that “independent audits and clear controls remain essential.”

FAQ – Denmark CPR Breach

What happened in the Denmark CPR breach?

An attacker used the CPR lookup access of Pays ApS, a two-person firm in Odense. The account made more than 14 million lookup attempts over about ten days in September 2026. About 8.8 million returned a name, address and CPR number.

How was the Denmark CPR breach discovered?

Through billing. The CPR office charges for each lookup. Officials spotted the activity while invoicing the firm on Oct. 2. The ministry announced the breach Oct. 5.

Did the breach expose all of Denmark?

About 8.8 million people were affected. Denmark has about 6 million residents. The register also keeps records on people who have died or moved abroad. People with name and address protection were not reached.

What has Denmark changed since the CPR register breach?

The CPR office told 1,039 companies with access to name a security officer, check staff access regularly and track monthly lookups. Its civil protection agency says a CPR number alone should no longer prove identity.

Should vendors with access to sensitive data carry cyber insurance?

Trua CEO Raj Ananthanpillai says yes, or the access should not be granted. If a small vendor cannot afford cover, he says, the grantor must restrict access tightly or carry the risk.

What should organizations ask before granting third-party vendor access?

Ananthanpillai lists unique strong credentials, mandatory MFA, no shared accounts, a named list of users and same-day removal of departing staff. He says the checks should repeat every few months.

Related Cyber Insurance Posts

• Shufti Projects A 40-Fold Rise In Document Deepfakes. Its CTO Sets Out The Limits.
• Cyber Insurance in Denmark and Sweden: Coalition and Allianz Launch Active Coverage in 2025(Opens in a new browser tab)
• Cyber Insurance Pays Back Only App. 60% of Ransomware Costs & Then Rates Go Up(Opens in a new browser tab)
• Supply-Chain Risk Continues to Bedevil Large Companies and their Cyber Insurers (Opens in a new browser tab)
• CFC Launches Cyber Proactive Response (CPR) Product(Opens in a new browser tab)