AI Weekly Malaysia

Denmark's national person register (CPR) disclosed a serious security incident in which unauthorized parties abused a Danish company's legitimate query access to pull names, addresses and CPR numbers for roughly 8.8 million registered citizens. Names and addresses of people with name-and-address protection were not included in the unauthorized access. CPR has cut off the company's access, reported the case to the Danish Data Protection Agency (Datatilsynet), and police are investigating alongside relevant authorities.

Why: The disclosed vector is not a hack of CPR itself but misuse of one company's valid lookup credentials, so the concrete lesson for anyone shipping or consuming bulk registry/lookup APIs is blast radius: a single trusted partner integration touched 8.8M records. The notice gives no root cause, no rate-limiting, logging or credential-control details, so there is nothing here to copy into a fix list yet — treat it as a prompt to check whether you could detect and revoke a partner pulling far more records than its normal pattern, and note that Malaysian builders working with centralized identity or government registry systems face the same trusted-partner exposure. If your stack has no bulk-query anomaly alerting or per-partner quotas, that gap is the actionable item; the breach itself requires no change to non-Danish systems.