Why Denmark’s Latest Data Breaches Look Alike

Welcome to Memorandum Deep Dives. In this series, we go beyond the headlines to examine the decisions shaping our digital future. 🗞️

This week, Denmark is still counting the cost of two data breaches that surfaced on the same Friday. One hit the Technical University of Denmark, where records on up to 200k current and former students, staff, and guests may be exposed. In the other, intruders reached the Central Person Register, the government’s list of everyone who lives in Denmark or once did, and copied the names, addresses, and ID numbers of about 8.8M people.

Neither attack looked like the break-in most people picture. The register breach came to light only because of an unusually large invoice, and the account behind it belonged to a small company in Odense. Within a week, the number of Danes with credit warnings on their records had nearly quadrupled.

Two decades ago, a U.S. data broker called ChoicePoint was burned in a strikingly similar way. Set side by side, the two stories point to what really decides the cost of a breach, and to why Denmark may soon see another one just like these.

ChoicePoint’s thieves got in by signing up as customers

Most people picture a data breach as a hacker breaking into a company’s computers to steal the data inside. However, in the autumn of 2004, a ring of identity thieves got hold of the personal records of thousands of Americans without breaking into anything at all. Their target was ChoicePoint, a data broker based near Atlanta that collected people’s names, Social Security numbers, birth dates, job histories, and credit records, and sold access to them to more than 50k businesses that wanted to check who they were dealing with. The thieves simply signed up as customers, posing as small businesses and sending their applications from public fax machines, and ChoicePoint approved them and sold them records the way it would to any other customer. The company only realized what had happened in October 2004, when police investigating identity theft contacted it.

It would be more than three months before the people whose records had been handed to the thieves were told, and that too only because of a 2003 California notification law, which required companies to tell people when their personal data had fallen into the wrong hands. ChoicePoint mailed about 35k letters to Californians in February 2005, and the Federal Trade Commission, the U.S. consumer protection regulator, eventually found that at least 163k people had been exposed, of whom at least 800 became victims of identity theft. The thieves never had to steal anything, because ChoicePoint had sold them the records, and the damage came afterward, when they used those records to pass as other people.

In the two decades since, breaches have become an ordinary part of life, because as more of life moved online, criminals found more data to take and more ways to profit from it. Europol, the European Union’s police agency, describes stolen data as a traded commodity that criminals use for extortion and identity theft. Most people now read the number in a breach headline and move on. However, ChoicePoint showed that two other details decide how much a breach costs, which are how the thieves got in and what the stolen information lets them prove.

Denmark learned about two breaches on the same Friday this month, and both carry ChoicePoint’s two details. In each case, the intruders came in through a legitimate login, took far more than that login was ever meant to reach, and left with the ID number Danes use for almost everything. These breaches look alike because Denmark has built much of daily life on that one number, stored it in system after system, and guarded each of those systems with an ordinary login that nothing stops from taking too much. Because the number is also treated as proof of identity, every copy taken from those systems is worth stealing, and the next breach will look much like these two unless that arrangement changes.

Two breaches surfaced in Denmark on the same Friday

The first came from the Technical University of Denmark, or DTU, which announced on October 2 that attackers had broken into DTUBasen, the system the university uses to manage who can log in to what. The attackers first took over several DTU user profiles and then used those accounts to download a large amount of data, and because DTUBasen holds records going back to 2003, up to 200k current and former students, staff, and guests may be affected. For current users, the data includes CPR numbers, names, and home addresses, though DTU has said it cannot yet confirm exactly what was taken.

The second breach was spotted on the evening of that same Friday at the Central Person Register, the Danish government’s list of everyone who lives in Denmark or has lived there. A member of staff noticed unusual activity which, according to officials, first showed up as an unusually large bill. Three days later, the digitalization ministry announced that intruders had copied the names, addresses, and ID numbers of about 8.8M people, a figure larger than Denmark’s population of about 6M because the register also holds people who have died or moved abroad. Christina Egelund, Denmark’s digitalization minister, said the access had run for about 10 days in September, and on October 10, Pays ApS, a small company in Odense, confirmed to Danish broadcaster TV 2 that the intruders had used its account, which, like those of many Danish businesses, was allowed to look people up in the register.

Both breaches ran through a login that nothing stopped from taking too much

The register breach shows the pattern most clearly. Danish law lets businesses with a legitimate reason search the register, though only for people they already know, and only one person at a time, so a company might use it to confirm a new customer’s address. However, nothing in Pays’s account limited how many people it could look up. The intruders used software to try one possible ID number after another and keep every number that matched a real person, a method known as ‘enumeration’. Officials later counted more than 14M attempts, of which 8.8M found a person, which means an account built to check one customer at a time was used to check almost the whole country.

The way into that account was just as ordinary. Authorities have not confirmed how the intruders got the password, but a person claiming responsibility told Danish newspaper Politiken that it was a former employee’s leaked password, “123456,” and Egelund has admitted that the security around the account was not good enough. Like ChoicePoint’s thieves two decades earlier, the intruders used a door the system had built for paying customers.

DTU’s breach followed the same route on a smaller scale, since the attackers logged in as real users and pulled what those accounts could reach. Jens Myrup Pedersen, a cybersecurity professor at Aarhus University, told the Danish outlet Sjællandske Medier that several Danish universities still run older systems that probably fall short of 2026 security standards. He did not comment on DTU’s own defenses, but he asked two questions that fit both breaches: how well the accounts that could reach personal data were protected, and whether any limit exists on how much data can be pulled out before an alarm goes off. At the register, the answer to the second question was a bill, and the danger was not new, since the Danish Agency for Societal Security, known as Samsik, had rated the cybercrime threat to Danish universities as very high in 2025. The logins differ from one breach to the next, but the prize inside each system is the same.

One number sits inside every system and doubles as proof of identity

Every person in the Central Person Register is given a 10-digit CPR number, which Danes use for public services, banking, and healthcare, and the first six digits are the person’s birth date, which is why software could guess them. Because the number is needed for so much, it ends up stored by universities and employers and reachable by the banks, insurers, and unemployment funds that, according to the Confederation of Danish Industry, depend on looking people up in the register. Each of those organizations is one more login standing between a criminal and a copy of the number.

That spread would matter less if the number only said who someone is. Security experts separate an ‘identifier’, which says who you are the way a name does, from an ‘authenticator’, which proves it the way a password does. However, pharmacies, clinics, and companies across Denmark had been treating the CPR number as both, so knowing a person’s number was often enough to be treated as that person. That practice ended almost overnight when Laila Reenberg, head of Samsik, told organizations to expect that people can no longer identify themselves with a CPR number.

Some of Denmark’s most important services had already moved past the number, which limits the damage. MitID, the national login, asks for a second step such as a code on a phone, so a CPR number alone cannot impersonate anyone wherever MitID is required. With those services protected, the main risk moves to scams, because a caller who can read out a stranger’s name, address, and CPR number sounds a great deal like a bank or a government office. That is why the ministry told people never to share passwords with callers who seem to know those details, and DTU gave its students and staff the same warning.

Danes moved quickly to protect themselves, and by October 7, about 970k people had placed credit warnings on their records, up from under 250k a week earlier. A credit warning is a note on a person’s record that tells lenders to check identity more carefully before approving a loan, and while it can protect one person, it does nothing about the number sitting in every other system. Jan Kaastrup, a Danish security expert, told TV 2 that treating the numbers as secrets no longer works, and Egelund has said she will announce plans for the register soon. However, the Danish government reads the same facts more calmly, arguing that the damage is limited because the number was never secret.

The government says the number was never a secret to begin with

The Danish government’s case starts with what the intruders did not take. Mikkel Leihardt, a department head at the digitalization ministry, said the register itself was not damaged and no other information was accessed, and Egelund said MitID was not affected. The numbers had also leaked before, since in 2013 a minister told the Danish parliament that hackers at the IT contractor CSC had copied files containing them. On this reading, nearly a million credit warnings are a precaution, and there is still no public sign that either copy has been sold or used for fraud.

A second argument reaches further, which is that the pattern is not Danish at all. Verizon, which publishes a yearly study of data breaches, found that stolen or misused logins were the first way in for 13% of breaches and that outside companies with access to another organization’s systems were involved in 48%, up 60% in a year. Seen this way, what looks like a Danish pattern may be how many breaches now happen everywhere.

Both arguments hold on today’s evidence, because no misuse has come to light and MitID still guards the services that move money. However, the first weakens on how the number was used, since Samsik would not have needed to warn businesses off the CPR number unless pharmacies, clinics, and companies had been relying on it. The second weakens on what the stolen logins reached, because elsewhere a stolen account might expose emails or files, while in Denmark two unrelated accounts, one at a small Odense company and one at a university, both led to the same number that still works as proof of identity.

In 2005, California’s answer to ChoicePoint was a letter, which told people their data was gone but did nothing to make that data less useful to the thieves who held it. Denmark has now sent its own letters, with DTU writing to current and former students and staff, and the ministry warning millions of residents about phone scams. What the letters cannot change is that the same number still sits behind many ordinary logins and is still hard to stop using as proof of who someone is. Egelund has set no date for her decision, and the security review has no deadline, which leaves open the question of whether Denmark will change the number, change how much it is trusted, or wait for the next stolen login to show the same pattern again.