Denmark's CPR Breach Is a Warning About Government Data Hoarding, and PhilSys Should Take Note

Denmark is the country people point to when they want to show that digital government can work. That is exactly why its latest breach should make every government with a central identity register stop and think, including ours.

On October 5, Denmark's digitalization ministry announced that outsiders had obtained the names, addresses and CPR numbers of about 8.8 million people registered in the Central Person Register (CPR). That count includes the living, the dead and people who have moved abroad. The register holds about 11 million records in total, while Denmark has roughly 6 million residents, as TechCrunch and The Next Web point out. People registered with name and address protection were not exposed, according to the ministry.

The register was not broken into. It was queried.

This is the part I want everyone to understand. Nobody cracked the CPR system itself. The ministry says the intruders abused "a Danish company's lawful access" to search the register, staying within the data private companies are allowed to see. TV 2 and DR identified the company as Pays ApS, a small data firm in Odense, and its managing director confirmed to TV 2 that the company's lawful access had been misused. Per TV 2, the company has two employees according to the Danish business register.

According to documents TV 2 obtained and a press briefing reported by The Next Web, the access began around September 10, more than 14 million automated lookups ran until September 20, and 8.8 million of them returned a record. Nobody noticed until the evening of October 2, when a staff member at the CPR office spotted an unusually large invoice for the company. Twelve days after the lookups stopped, the bill was the alarm.

How did they get in? The official account still says only that the company's access was misused. A person claiming to be the attacker told Politiken they logged in with the password "123456", and Politiken reported that at least three Pays accounts, including an administrator account, used that password, as summarized by The Register. DR independently found "123456" among the company's passwords in an old data leak, but says it could not confirm that this was the account that was abused. The claimant also said they did not intend to sell or leak the data. None of that has been confirmed by the authorities, so treat it as the hacker's account, not an established fact.

The national police unit for serious crime is investigating, the Danish data protection authority Datatilsynet received the notification on October 4, and as of the latest reports no one has been charged. The ministry has ordered a full security review of the CPR and says it has put measures in place to prevent a repeat. The CPR office told Datatilsynet it has now added a fixed billing check for abnormal usage, per DR.

Why I keep saying governments should not hoard data

A central register is a promise: give us everything once, and we will keep it safe for everyone. The problem is that the promise is only as strong as the weakest party allowed to read from it. Denmark did not lose this data through its own front door. It lost it through a two-person company with a bulk lookup account, apparently without the kind of login protection we would demand for a personal email account, and without any monitoring that could tell 14 million lookups from normal business.

And the damage cannot be rotated away. You can change a password in a minute. You cannot change your name, your address history or, in practice, a national ID number you have carried since birth. Denmark's minister told TV 2 it was too early to say whether people would get new CPR numbers, per The Next Web, and the ministry is already warning people that callers who know their name, address and CPR number are not proof of anything. The more a state collects in one place, and the more parties it lets query it, the bigger and more permanent the blast radius when one of them slips.

What this means for PhilSys

I support a working national ID. It cuts red tape and helps people who were left out of the system get banking and services. But PhilSys is now big. The Philippine Statistics Authority (PSA) reported 90,290,024 registered and verified Filipinos as of October 31, 2025, and National Statistician Claire Dennis Mapa told lawmakers in September that about 97 million are now registered, BusinessMirror reported. Under Republic Act 11055, the registry holds demographic data plus a front-facing photo, a full set of fingerprints and an iris scan. That is far more sensitive than a CPR lookup.

PhilSys is also built to be queried. Section 12 of the law lets government agencies and private entities ask the PSA to authenticate a person, and the PSA counted 94.7 million authentication transactions by the end of March 2026, including 17.2 million from financial accounts and 13.4 million from the private sector. The government is now preparing a ₱2.48-billion project, under a public-private partnership, to upgrade and run the system, including the integration of banks and businesses, according to BusinessMirror. Every one of those connections is a door like the one Pays had in Denmark.

To be fair, the law already gets some important things right. Section 8 limits what may be collected, Section 17 bars disclosure without consent, and Section 12 says requesting entities must get consent and use the information only for the stated purpose. Those are good rules. Denmark shows that rules on paper are not enough when one partner's login is weak. So here is what I would like to see, constructively:

• Answer yes or no, not with records. Authentication should confirm that a person is who they claim to be, and return as little data as possible. A partner that only needs a match should never be able to pull an address.
• Collect and keep less. Every field that is not stored cannot leak. Review what each partner really needs, and expire what nobody needs anymore.
• Don't put everything in one place. Keep biometrics separate from demographic data and partner access, so that one compromised channel cannot reach both.
• Mandatory strong authentication for every partner. Phishing-resistant MFA, no shared accounts, and no way to set "123456" at all. The PSA should audit this before connecting a partner, not after.
• Rate limits and real-time anomaly alerts. A partner whose volume jumps far above its customer base should be throttled within minutes, not discovered on an invoice weeks later.
• Independent audits, published. Regular third-party security reviews of the PSA and its biggest connected partners, with summaries the public can read.
• Breach transparency. If something happens, tell people quickly and plainly, the way Denmark did within days, and tell them what to watch out for.

Denmark will recover, and its quick public disclosure deserves credit. But the lesson is not "Danes picked a bad password." The lesson is that a central register is only as safe as everyone with a key to it, and that the safest data is the data a government never collects in the first place. We still have time to build PhilSys with that in mind.