Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
Summary
Attackers in Denmark gained access to the CPR data, including names, addresses, and personal identification numbers, of approximately 8.8 million people. This was achieved by exploiting a private Danish company's authorized access to the Central Person Register (CPR).
IFF Assessment
FOE
This incident represents a significant data breach, exposing sensitive personal information of millions of individuals, which is detrimental to defenders.
Defender Context
This incident highlights the critical need for robust access controls and monitoring of third-party access to sensitive data. Defenders should be vigilant about potential supply chain attacks and ensure that partners with privileged access have adequate security measures in place to prevent unauthorized data exfiltration.