Dom Development Data Breach: How Buying a Home Put Families' Identities at Risk
The Dom Development cyberattack exposed PESEL numbers, salaries and children's data. What leaked, what it means, and how to protect yourself now.
Incidents
Denmark CPR Data Breach: 8.8 Million People Exposed Through a Private Company's Account
Attackers spent 10 days pulling names, addresses and CPR numbers via a partner firm's legitimate access. What it teaches about third-party access risk.
Denmark’s Ministry of Digital Affairs has disclosed one of the largest data breaches in the country’s history. Attackers took data on roughly 8.8 million people from the Central Person Register (CPR). That is about 80% of all entries in a register that holds around 11 million records.
How It Happened
No one “hacked” the register in the usual sense. The attackers used the legitimate access of a private Danish company that was authorized to use the CPR. For about 10 days in September, they ran automated queries that worked through ID numbers one after another. On Friday, October 2, a member of the register’s administrative staff spotted the unusual traffic. The breach was made public on October 5.
What Data Was Exposed
- first and last names,
- addresses,
- CPR numbers, Denmark’s equivalent of Poland’s PESEL national ID number.
The breach covers living and deceased people, as well as people who have moved abroad. It did not include people whose addresses are protected.
How the Authorities Responded
The company’s access to the register was revoked. The incident was reported to the Danish Data Protection Agency (Datatilsynet), police opened an investigation, and Minister Christina Egelund ordered a full security review. Citizens were told to watch out for fraud attempts, avoid clicking suspicious links, never share their MitID login credentials, and place a credit freeze. A dedicated hotline was also set up.
Lessons for Poland
This breach did not depend on any flaw in a government system. All it took was one organization with access and weaker security. There are three takeaways for any organization that shares data with partners or uses data that belongs to someone else:
- Rate limits and anomaly detection. Ten days of mass queries is far too long. Per-account query limits and alerts on unusual traffic should trigger within hours, not after a week.
- Least-privilege access. A partner should see only the data it actually needs, and only at the pace its work requires.
- Third-party access management. Who holds the keys, how are they protected (MFA, IP allowlisting), and when was this last reviewed? NIS2 explicitly requires risk assessment across the supply chain.
In Poland, it’s also worth remembering that you can freeze your PESEL number (zastrzeżenie numeru PESEL) for free in the mObywatel app. It’s a simple way to limit the damage from a breach like this one.
Sources: The Hacker News, The Copenhagen Post, SecurityWeek
