一名未经授权的第三方滥用了一家丹麦私营公司对该国中央人口登记系统（CPR）的合法访问权限，导致约880万人的姓名、地址、身份证号码及其他个人信息泄露。CPR管理局在一份声明[PDF]中表示，于10月2日发现9月期间存在异常活动，并在周末确定了泄露的规模。数字化部长克里斯蒂娜·埃格伦德在昨晚的电视采访中表示，目前下结论该国是否会重新发放所有CPR号码还为时过早，这是泄露事件后提出的解决方案之一。
An unauthorized party abused a private Danish company's legitimate access to the country's Central Population (CPR), exposing names, addresses, identification numbers, and other personal information about approximately 8.8 million people. The CPR administration said in a statement [PDF] that it became aware on October 2 of irregular activity during September and established the scale of the breach over the weekend. In a TV interview last night, digitization minister Christina Egelund said it was too soon to say whether the country would issue all-new CPR numbers, one of the solutions proposed following the breach.
丹麦网络安全专家扬·卡斯特鲁普对TV 2表示，将CPR号码视为机密的做法是“失效”的，并主张仅凭号码不应被接受为身份证明。“我们生活在一个数字化社会，因此我们应该拥有更好的身份识别系统，”他说。埃格伦德将遭滥用访问权限的公司描述为“小型企业”。根据《丹麦民事登记制度法》第38条第1款，私营企业可在部门规定的访问条款[PDF]限制下获取CPR数据。
Danish cybersecurity specialist Jan Kaastrup told TV 2 that treating CPR numbers as secrets was a "broken" approach and argued that a number alone should not be accepted as proof of identity. "We live in a digitalized society, and therefore we should have much better identification systems," he said. Egelund described the company whose access was abused as "small." Private businesses can obtain CPR data under section 38(1) of the Danish Civil Registration System Act, subject to restrictions set out in the ministry's access terms [PDF].
合格接收方包括公司、基金会、其他法人实体及从事商业活动的个人。然而，访问权限仅涉及预先单独确定的特定人群，且接收方必须依据GDPR和丹麦数据保护法合法享有处理该信息的权利。记者询问部门为何授予如此广泛的访问权限。CPR号码是丹麦获取公共服务及进行许多日常交易的基础，该国人口约600万。该数据库还包含居住在格陵兰的55,000多人的信息，他们同样使用CPR号码办理医疗、税务和银行业务。
Eligible recipients include companies, foundations, other legal entities, and individuals conducting business. However, access concerns a defined group of people identified individually in advance, and recipients must be legally entitled to process the information under the GDPR and Danish data protection law. The asked the ministry why such broad access was given. CPR numbers underpin access to public services and many everyday transactions in Denmark, which has a population of around 6 million people. The database includes the information of over 55,000 people living in Greenland who also use CPR numbers for healthcare, tax services, and banking.
该数据库中约有1100万条记录，其中包含了已去世或移居海外的人士的信息，这也解释了为何受影响的总人数超过了丹麦当前的人口总数。该部门还指出，那些选择对姓名和住址进行保密处理的人士的信息并未遭到泄露。CPR管理机构已切断涉事公司的访问权限，并表示正与专家及相关监管部门合作，以查明事件原委。目前该机构已向丹麦数据保护局报备，警方也正在展开调查。®
The ministry said the contains approximately 11 million records, including people who have died or moved abroad, which explains why the affected total exceeds Denmark's current population. The ministry also noted that names and addresses of persons who chose to with name and address protection were not exposed. The CPR administration blocked the unnamed company's access and said it was working with specialists and relevant authorities to establish what happened. It has notified the Danish Data Protection Agency, and police are investigating. ®