This comes only a few days after a data breach was reported at the Technical University of Denmark [1], exposing the personal records of current and past students, faculty and staff. That included their CPR numbers (government id at the central person registry), that could for example be used to look up their official place of residence. All in all, it seems likely that someone just got the table they needed to join on the first breach.
I'm seriously at a point where I'm opposed to talking to my doctor because the information may be digitally recorded and leaked, going on a flight because my passport may be used to aqquire a loan by cybercriminals, comparing car insurance because my phone will be called by robocallers selling me things or verifying my ID with websites because it might be used to associate my information with whatever else I do online.
I don't think, for a vast majority of cases, these companies I'm forced to interact with can be trusted with my data and it's having a real world negative impact. Even with the best intentions the information is somehow valuable to steal and I'm baffled how it's not secure.
There should be some consequences for companies asking for things like SSN/National Insurance numbers on job adverts or retaining drivers licence photos after test driving a car, they just don't need the data anymore.
I am at a point where I simply stopped worrying and began to love the bomb. I did my best, I really did - degoogled before it was trendy, dropped all social media, built a homelab for complete data ownership, set up matrix messaging with family, and so on - but it feels like a wasted effort at this point.
All my data is out there, one way or another, and a dedicated cybercriminal - or worse, a government entity - can obtain or exfiltrate it without issues. I know it, they know it, everyone knows it.
The only thing I can change now is my reaction to this fact, and although the idea of off grid autarky is tempting, I am not there yet. I just don't want to stop living - flying abroad, going to doctors - I just accept that privacy in the current state of human condition is impossible, and move on with my life.
>I simply stopped worrying and began to love the bomb
This may apply to the consequences of ones data being subject to so many breaches and leaks and thefts, but it should not be the attitude one adopts towards the idea of ones data being taken and used by so many parties. At some level, my data is my personhood - it is my evidence of myself, and my record of myself, and my proof of myself. It encodes who I talk to, what I'm interested in, where I go, and what I do. My health, my finances, my habits, vices, schedule, family, friends, coworkers, beliefs. People more clever than myself use this data to advertise to me; people more powerful use this data to surveil me. When will people more malevolent use this data to persecute me?
I should not have to love the bomb because the bomb will kill me.
These swings can be avoided by not doing stuff so hard but instead more effectively.
For example, matrix sucks ass. It's terrible. Everything about it is a bad experience.
Of course you'd want to eventually stop using it and go back to the previous life.
But that is not the correct take-away.
The correct take away is to include UX (and honesty to yourself about it) in the calculation and to not go all in on an unsustainable compromise, just to then snap back to doing the opposite ca 3 months later.
Same as with loosing weight, really. If you replace 100% of the pleasure of eating with the "right" but unpleasant solutions, you will not be able to keep that diet going indefinitely.
Similarly. My browser was carefully containerized, with a ton of anti fingerprinting measures, VPN, Linux, Librewolf, everything. Even on my phone, I restricted whatever possible. Then one day I went to the YouTube main page, and I saw that Google somehow got to know that I played Minecraft again after a decade. I gave up right there. I suffered to avoid this, and it was pointless. I knew at that point already that probably all my PI is public information anyway, but I wanted to restrict whatever possible, and no, everybody sells my data anyway, and it seems that avoiding fingerprinting is impossible without turning off the internet completely, and ditching smart phones.
> Google somehow got to know that I played Minecraft again after a decade. [...] I knew at that point already that probably all my PI is public information anyway
How are you jumping from Minecraft (probably one of the most watchtime-generating content types out there) being displayed on your main page to… your personal information being known to everyone?
>Then one day I went to the YouTube main page, and I saw that Google somehow got to know that I played Minecraft again after a decade
Did you play minecraft on the same network? If so, I'm not sure why the results are surprising or why it would negate all your efforts. If someone else played minecraft on your network you would also see a minecraft video on your main page I would imagine.
It's a bit like physical security of your house - could someone break into my house, not easily but it's a house not a bank vault. Keeping our gate closed and having a large dog (who is actually very friendly) about the place probably keeps the vast majority of possible thieves away.
I think both are possible. To have a goal and to accept reality. I would not draw the conclusion that all privacy measures are meaningless. It is hard, but I think it is still worth working towards a goal of better privacy for citizens.
Evidence is pretty clear after decades of this: big data breaches are inconsequential for an average person.
They happen all the time, nobody cares, criminals who want to target you will target you anyway, criminals who don't target don't care about you specifically, legitimate entities cannot use this data anyway, and legitimate scammers (marketing) will find different ways to get you to give them the data you need.
At this point I thing privacy obsession is modern copium, a way for people to deal with the fact that we're all individually a speck of dust on the face of human civilization. It's about asserting, "I am not an NPC, I have this richness of experience", and then trying to hide it all in case the world wants to check.
I love the bit where a programmer always proudly chimes in with this statement as if it means anything.
You dont get it bro, its not a good vibe.
And if I had bean in management I would have fired anyone involved with that decision.
Why is it so often HN that I point something obvious out , like Rockstar having clearly failed management and a complete loss of control, but instead of agreement or silence I always get flak from some random user who just doesnt get it, and then a year later the company starts falling apart.
Im just a guy who recognises patterns and im not even smart.
> Why is it so often HN that I point something obvious out
Because many "obvious" things are just plausibly sounding bullshit. For example:
> Rockstar having clearly failed management and a complete loss of control
That's both very broad and generic, and completely unfalsifiable, and comes with nothing backing it up. It's just an unsubstantiated opinion. These things are fine when drinking in friends, or otherwise socializing by bonding over ramblings.
If you want to convince someone of something, the standards of evidence (not to mention, clarity of thinking) are a bit higher.
In France the french IRS leaked infos about the wealth of its citizens and evil thieves cross-checked it with leaks of people who ordered hardware wallet for cryptocurrencies and families are getting kidnapped and tortured. In a recent case three family members have been beaten over two days so that... 40 000 EUR could be stolen.
That's the world we live in.
"Police and thieves", collaborating one way or another (leaking data collected by big brother and then having big brother being very soft on crime is one way to collaborate with evil people), "to scare the nation with their guns and ammunition" (as in the reggae song).
As much as I don't like the cryptocurrency ecosystem, I don't think facilitating and encouraging kidnapping and torture is the way to go.
> There should be some consequences for companies […] retaining drivers licence photos after test driving a car, they just don't need the data anymore.
I know it’s modern American tech tradition to make fun of the GDPR, but this is genuinely one of the things it stipulates: You’ll get at least a slap on the wrist, or potentially much
worse, if you needlessly keep data around longer than necessary to do the task you had collected it for in the first place.
I said it before as well, but it’s because nothing “publicly really bad” happened despite the leaks and stolen information over the past decades. After Equifax breach, everyone got tired, because company survived, and whatever identity theft happens from time to time gets swept under the rug. It didn’t impact most people’s lives, despite leaking half of the US’s SSNs and etc. Then fatigue kicked in, and with subsequent leaks everything just mellowed down, so nobody cares.
I’ve switched to operate with the idea that my information has already been leaked at some point. I should be generally ready to fix the problems if/when identity theft happens, rather than inconveniencing myself and figuring out the third party trust situation.
There’s nothing lucrative in abusing privacy, and yes the government is busy but it has nothing to do with a "corporate agenda", any government or any country with more than a few millions of people is busy, agenda or not.
> where I'm opposed to talking to my doctor because the information may be digitally recorded and leaked
Let me say "Hi mate, +1". State doctors? There are territories in which a pharmacological prescription is shared DB only now (where previously they could be on paper - a secret between you, the pen, the paper, the pharmacist and the gods). Private entities? Good luck finding one that does not require a privacy waiver as a condition for the visit. Searching for a medical dock (a dock for a doc), calling them to ask? "This is a recorded message. If you proceed with the call then you agree..." (Hang-up click).
Yeah, it's old-school people control. This said, these days it could be done electronically, without the hotel storing physical information: at check-in, you put your passport in goverment-issued, (hopefully) tamper-proof machines, the hotel confirms length of stay, police server gets the info and that's it; early checkouts, the hotel must notify via some web portal. It would be relatively easy to implement.
But nobody really cares enough to spend money modernising this sort of system.
> This said, these days it could be done electronically
Are you 'avin a laugh mate?
A photocopy of my passport is going nowhere and is shreadded afterwards. An electronic copy..... God lord.
The GDPR also requires data deletion once you no longer need it; physical as well as electronic. This is common sense, and why some organisations don't do this is simply mind boglling.
The whole point is that the hotel would not even get a copy, the machine would just send hashes around and the hotel would only get an anonymous transaction ID to store. It would probably be even more secure than what you have today at the airport.
If you think photocopies kept in some folder accessible to anyone working in the hotel, with a promise to delete it at some point, is "secure" in any way, I don't know what to tell you.
I know, and it's really the trade-off whenever this sort of system is centralized: you can better secure the leafs, but the central repository becomes an even juicier target.
This said, the police already has a database with these info, and it likely is somehow already on the network, so adding an api (if done properly) would not dramatically alter the exposure profile.
I just tell them they can look at it but not copy it and that's satisfied them, for now. Sometimes had to get a manager in, but never had them deny me fully. I'm sure sooner or later I'll run into a stubborn one and have to scramble for a day-of replacement hotel, and that just adds to my list of reasons to avoid travel.
If democracy really worked, and your desire to spy on politicians is shared by enough people, supposedly, you should be able to create your own party which has that explicit goal. Maybe find a few other goals, or you will end up like the pirates :-)
I am writing this because I don't think democracy works as advertised.
This is just a general American complaint that has merit on its own, but has nothing to do with the article and is just derailing any discussion about the article itself and driving the conversation to your own personal concerns about something completely separate.
In this case, the EU does have consequences for data breaches where proper protocols are not followed.
Additionally, this is not private information .. most anyone can look this information up. ID numbers are not confidential information like SSNs are treated in the US.. they are just a number to tell person A from person B. You give this number to everyone without thinking about it because it's how every company you interact with identifies you.
In this case a rogue company, or compromised company, used their access to contact the central database to download everyone's information.
In my country we essentially use the same system, except for we still allow companies to download the whole database if they want to instead of making individual queries.
In this case the access to their system was unauthorized, and under GDPR data breaches have to be reported within 72 hours. Companies can't make the decision on their own that it's not a big deal.
In Sweden, to avoid this kind of malicious leaks, we leak the residents' data officially. https://hitta.se lets you look up personal numbers, names, addresses, birthdays and sometimes phone numbers of any resident. The residents are not asked for consent, the data goes there automatically (some of my friends had success with having it removed from hitta, but it comes back once you change residence address).
It's quite convenient, when you meet a new friend, to go and check what neighbourhood they're from, who do they live with and where they lived before.
What's the big deal, Danes? What do you have to hide?
(The provocative tone is intentional as a joke, I'm not even a Swede, I just find the brotherly rivalry between Scandinavians amusing.)
Are there no murderers, crazy ex-boy/girlfriends, targeted harrassment and spam calls in Sweden?
Not that any other country does much better in this regard. Still it sounds a little wild to me that you can get this information without even needing to hit a shady forum and download some csv. Maybe lowers the bar too much.
I've been told back in the day it was quite normal get a physical, dead-tree book with similar information sent out to you every year, until people decided that was a waste of paper.
It used to be illegal here to reverse look up a name matching to a phone number, since it was "owned" by the state telephone company and they didn't want that happening. But you were allowed to reverse look up the address of a number and then look up the person and match it to the number. So that magic happened under the hood. The trick was getting the residential information but since that wasn't a problem in the '90s I'm sure it is even less of an issue now.
I have been advocating for Denmark to do the same for 15+ years. The fact that your social security number can be used for anything on it's own is a disaster. Mostly it can't anymore, because you have to do electronic signing with MitID, but it's still considered secret. If you own a home in Denmark, address information is already public, but a little hard to lookup.
The problem with this leak mostly going to be those with hidden addresses or secret phone numbers. Last time something similar happened was when it was shown that you could pretty much just guess a persons social CPR number if you had their birthday. Normally you could narrow it down to 6 or 8 possible numbers then use the phone companies websites, pretend to create a new account, enter the CPR number and check if you guessed correctly. Because the demo was done with politicians, then phone companies no longer ask for CPR upfront.
The review conducted shows that the unauthorized access does not include the names and addresses of individuals who have chosen to register with name and address protection.
I feel like this should be the default. Responsible disclosure to the affected company, followed immediately by disclosure to every politician in the dataset. Once we start collecting high profile cases this way instead of waiting X days for a faceless corporation to release a fix, companies will think twice about their security and the data they collect if that could make them end up on the shit list of the local government.
I was actually surprised when I heard about this for the first time. Also I've heard that even the salaries of people are publically available. That's really cool.
This probably improves economic efficiency a lot. Want to build something and remember meeting a relevant expert 3 years ago at a party? Easy to find that person and start doing business...
Just that easily all the private conversations of everybody in the EU can leak if Denmark succeeds at outlawing E2E encryption with its Chat Control proposal.
Not trying to downplay the situation, but I hope this will be eye opening to the responsible people.
Unfortunately, for the people who strongly believe that Chat Control is the way, they will use these types of events as further evidence as to why spying on everyone is the best deterrent.
For those not getting the scope of this. The following has been compromised for all living danish citizens and foreign nationals which have had recidence. And quite a few dead ones as well.
- Social security number
- Age
- Sex
- Family relations
- Physical address
- Protected addresses
- Sex change
This is a country with quite good health records. Unfortunately also previous problems with proper non-reversible anonymisation of said data when used for research.
It's honestly worse. DDMMYYY (the last Y is from a lookup table to know if it's 18YY, 19YY or 20YY). If a person is born before October 2007 you can even do a checksum using the last digits to verify using the last digits. And yes, last digit is an even number for women, and uneven for men.
I think it is worth mentioning that age and sex is encoded in the social security number.
There are exceptions where the encoded birth date will be wrong (like immigrants with unknown birth dates) or dates where there are more people than the 4 digits that encode checksum validation and gender can handle.
I learned a few days ago from a friend, when this was reported in the Danish media, that the "random" part is only 4 digits and as a bonus is sequential. So if you register in the country as foreign citizens together with your partner those are likely sequential.
Then again, in my country some municipalities handed out numbers starting with your birth year....
A good time to remember that cramming data into your identifiers will come back to bite you... It hasn't really been necessary since databases replaced library catalogs anyway.
I think they do this to make it easier to remember your number. It’s really not private data in the Nordics as others mentioned, even your address and phone number and , on request, salary can be easily found out legally.
When you change your address you can click a checkbox saying you want a protected name/address. This means that companies that have you as customers/clients won't be able to get the new address, mail won't be redirected, etc
I did it accidentally during my last move and it was a pain in the behind
And it expires after a year by default so it feels rather pointless
You can just apply for protected address. I did that once, because I did not want that my .dk domains whois would show my name and address.
I managed to get protected address, it's just to log in somewhere and request it. I can't remember the details, but it made for example banking _slightly_ more annoying. They would call me so they can send me a letter. Also makes it harder for people who know your name to look up your address.
Never managed to get my name removed from my domain whois and at some point removed protected address again. In theory, if I share one of my other .com domains on the internet, an attacker could reverse DNS the IP, find my DK domain and thus get my full name and address.
Nobody knows exactly what was accessed. What you have listed is what the register contains, not what was accessed. People with "Protected addresses" have specifically not been compromised.
As someone who spend a decade in the Danish public sector, among other things working in groups on national architecture. I'd say that we reap what we sow. IT and digitalisation is not taken very serious in our public sector. In most places it's placed under something, and until recently it didn't have it's own ministry. Right now it's even a shared ministry, and there is little focus on cyber security. What has arrived in recent years is solely based on the thread of hybrid attacks from Russia.
Compare this to the ministry of transportation, which has full resources. This is despite the fact that most people in this country spend less time commuting than they do working on a computer. Not that transportation isn't important, but maybe digitalisation is as well?
My personal CPR has been leaked a couple of times though. Hilariously the first time it was leaked when a couple of unencrypted laptops were stolen from the biggest IT union in the country. We have a system in place where you can flag your CPR as having been leaked. Though I suppose now we might as well consider every one of them to be leaked. In theory a CPR on it's own was never meant to give any sort of authority or access, but again, this wasn't the practice in a lot of place. So I guess this leak may be a blessing in disguise in that sense as well, as it'll highten security because of broken trust.
> IT and digitalisation is not taken very serious in our public sector.
I think I get what you are trying to say, but just for other people reading this: Denmark is one of the "best" / advanced countries when it comes to IT and digitalisation in public sector in Europe.
Maybe 10 years ago, but other nations have caught up. Italy has their Sistema di Interscambio. Germany and France have taken digital sovereignty serious. Spain is big on open source (and ruby for some reason). Estonia has been miles ahead for more than 10 years. It's true that we have some ease of use systems compared to most of Europe, but we also have a lot of horror stories.
That being said it's not like us being shit at cyber security doesn't mean other countries aren't also shit. Look at Australia getting hacked by AI. I know it's all the rage to blame OpenAI, but really, shouldn't Australia count itself fortunate it wasn't an enemy nation state? Or that their lacking security got exposed before it was.
You're conflating two different things here. What Denmarks excels at it implementing public IT solutions that makes processes smoother, like patient records, medical perscriptions, digital signature, a nation-wide digital identity, things like that. Digital sovereignty isn't part of this, and Denmark isn't particularly good at it, nor is it really valued that highly. Same for cyber security, I'd say that it's down to dumb luck that it's not worse. There is a city, Randers, they can't send email to the domain anders.dk (Anders being a pretty normal Danish name). Why? Because the butterfingered public employees in Randers could stop sending personal information about citizen to anders.dk, which has a catch-all email. They simply forgot the "r". The problem is the lax attitude to emailing sensitive information, probably via a Microsoft run Exchange server, but rather than fixing that, they just blocked the anders.dk domain.
Mhh, I don't know. In Germany they proudly proclaimed their BAföG / Student loans (SU in Denmark) is now digital. But what was digital was just the client side, on the government agency side they still would print out the applications. And because they where used to people sending in paper, they had to hire more people to help with the printing. AHHHHH. That is the state of German digitalisation.
There are things I wish I could change in Denmark, mainly the power sockets and number system (Base 20 what the heck?) but Denmark is on a good course when it comes to IT understanding. Both the broader society and government implementations.
Yes yes, Estonia is better. But Denmark is still doing good.
Can't speak for the Danish govt in general, but you should look up the history of the property tax scandal and the projects that tried to fix it. I was part of the third attempt to rectify the problem at SKAT.
The article mentions that they accessed the information through a Danish company whose access has been revoked now. I find it really surprising that a company could access these records without any limitations on which info or how many records they can pull.
The EU would rather destroy our right to privacy than hold criminals accountable. If I sound bitter it's because I have become very bitter over the last decade. The EU appears very effective at picking on individuals and people who can't fight back, and absolutely toothless when it comes to taking on more powerful interests. There are very few cases of the EU tangibly improving my life over the last decade, and countless examples of making it worse.
As someone who works with CPR data in Denmark, this does not surprise me at all. Private companies access the data through an API, and anyone who works at such a company can look up CPR data as they please.
This is were security meets the real world. The number is not secret but people have been taught to keep it confidential. And when you know the last 4 digits social engineering har become a lot easier.
But since then I have experienced how scared mugglers get when they get a threatning mail with the only legitimacy of naming and old leaked password.
This will be easy to exploit on a scale.
Scammers used to prey on the weakest hence the many Nigerian Princes. But as they get more sophisticated and move up the chain they start to look more and more legitimate.
it feels this will keep happening specifically to Europe for three reasons:
a) most countries took an anti-AI approach
b) they reject frontier models in favor or "Sovereign" solutions
c) they're replacing software with weaker/more vulnerable options
public servant engineers are token poor and will be out of the latest defense tools
This comes only a few days after a data breach was reported at the Technical University of Denmark [1], exposing the personal records of current and past students, faculty and staff. That included their CPR numbers (government id at the central person registry), that could for example be used to look up their official place of residence. All in all, it seems likely that someone just got the table they needed to join on the first breach.
[1] https://www.dtu.dk/english/newsarchive/2026/10/cyberattack-o...
I'm seriously at a point where I'm opposed to talking to my doctor because the information may be digitally recorded and leaked, going on a flight because my passport may be used to aqquire a loan by cybercriminals, comparing car insurance because my phone will be called by robocallers selling me things or verifying my ID with websites because it might be used to associate my information with whatever else I do online.
I don't think, for a vast majority of cases, these companies I'm forced to interact with can be trusted with my data and it's having a real world negative impact. Even with the best intentions the information is somehow valuable to steal and I'm baffled how it's not secure.
There should be some consequences for companies asking for things like SSN/National Insurance numbers on job adverts or retaining drivers licence photos after test driving a car, they just don't need the data anymore.
I am at a point where I simply stopped worrying and began to love the bomb. I did my best, I really did - degoogled before it was trendy, dropped all social media, built a homelab for complete data ownership, set up matrix messaging with family, and so on - but it feels like a wasted effort at this point.
All my data is out there, one way or another, and a dedicated cybercriminal - or worse, a government entity - can obtain or exfiltrate it without issues. I know it, they know it, everyone knows it.
The only thing I can change now is my reaction to this fact, and although the idea of off grid autarky is tempting, I am not there yet. I just don't want to stop living - flying abroad, going to doctors - I just accept that privacy in the current state of human condition is impossible, and move on with my life.
>I simply stopped worrying and began to love the bomb
This may apply to the consequences of ones data being subject to so many breaches and leaks and thefts, but it should not be the attitude one adopts towards the idea of ones data being taken and used by so many parties. At some level, my data is my personhood - it is my evidence of myself, and my record of myself, and my proof of myself. It encodes who I talk to, what I'm interested in, where I go, and what I do. My health, my finances, my habits, vices, schedule, family, friends, coworkers, beliefs. People more clever than myself use this data to advertise to me; people more powerful use this data to surveil me. When will people more malevolent use this data to persecute me?
I should not have to love the bomb because the bomb will kill me.
These swings can be avoided by not doing stuff so hard but instead more effectively.
For example, matrix sucks ass. It's terrible. Everything about it is a bad experience. Of course you'd want to eventually stop using it and go back to the previous life.
But that is not the correct take-away.
The correct take away is to include UX (and honesty to yourself about it) in the calculation and to not go all in on an unsustainable compromise, just to then snap back to doing the opposite ca 3 months later.
Same as with loosing weight, really. If you replace 100% of the pleasure of eating with the "right" but unpleasant solutions, you will not be able to keep that diet going indefinitely.
Similarly. My browser was carefully containerized, with a ton of anti fingerprinting measures, VPN, Linux, Librewolf, everything. Even on my phone, I restricted whatever possible. Then one day I went to the YouTube main page, and I saw that Google somehow got to know that I played Minecraft again after a decade. I gave up right there. I suffered to avoid this, and it was pointless. I knew at that point already that probably all my PI is public information anyway, but I wanted to restrict whatever possible, and no, everybody sells my data anyway, and it seems that avoiding fingerprinting is impossible without turning off the internet completely, and ditching smart phones.
> Google somehow got to know that I played Minecraft again after a decade. [...] I knew at that point already that probably all my PI is public information anyway
How are you jumping from Minecraft (probably one of the most watchtime-generating content types out there) being displayed on your main page to… your personal information being known to everyone?
because it’s the same process of intermediaries accumulating, inferring and sharing data to each other
intermediaries that will be compromised
>Then one day I went to the YouTube main page, and I saw that Google somehow got to know that I played Minecraft again after a decade
Did you play minecraft on the same network? If so, I'm not sure why the results are surprising or why it would negate all your efforts. If someone else played minecraft on your network you would also see a minecraft video on your main page I would imagine.
The next frontier is to maintain 'limited privacy'.
That's denying most culprits the opportunity to use the collected data against you.
Like always on VPN, turning off personalization, ad guards and using open source products where possible.
It's a bit like physical security of your house - could someone break into my house, not easily but it's a house not a bank vault. Keeping our gate closed and having a large dog (who is actually very friendly) about the place probably keeps the vast majority of possible thieves away.
That's still a bit on the obsessive side. The reasonable position is the same as it always has been in the real world too:
- Don't volunteer your intimate details left and right;
- Feel entitled to deny requests for unnecessary data (and advocate for such rights if you're in position to)
- Otherwise don't sweat it, because you can't actually control what others know about you, you never could
I think both are possible. To have a goal and to accept reality. I would not draw the conclusion that all privacy measures are meaningless. It is hard, but I think it is still worth working towards a goal of better privacy for citizens.
Evidence is pretty clear after decades of this: big data breaches are inconsequential for an average person.
They happen all the time, nobody cares, criminals who want to target you will target you anyway, criminals who don't target don't care about you specifically, legitimate entities cannot use this data anyway, and legitimate scammers (marketing) will find different ways to get you to give them the data you need.
At this point I thing privacy obsession is modern copium, a way for people to deal with the fact that we're all individually a speck of dust on the face of human civilization. It's about asserting, "I am not an NPC, I have this richness of experience", and then trying to hide it all in case the world wants to check.
> big data breaches are inconsequential for an average person
A relative killed herself after her therapist was hacked[1] and the data was leaked. If that is inconsequential, I do not know what isn't.
[1] https://en.wikipedia.org/wiki/Vastaamo_data_breach
I gave up when i realised Firefox had google analytics and noone even knew or cared. That was about 10 years ago now.
Because it did not. Extensions page used them but nothing else.
I love the bit where a programmer always proudly chimes in with this statement as if it means anything.
You dont get it bro, its not a good vibe.
And if I had bean in management I would have fired anyone involved with that decision.
Why is it so often HN that I point something obvious out , like Rockstar having clearly failed management and a complete loss of control, but instead of agreement or silence I always get flak from some random user who just doesnt get it, and then a year later the company starts falling apart.
Im just a guy who recognises patterns and im not even smart.
> I love the bit where a programmer always proudly chimes in with this statement as if it means anything.
So you knew that fierfox never came with google analytics but you decided to claim it anyway...
> Why is it so often HN that I point something obvious out
Because many "obvious" things are just plausibly sounding bullshit. For example:
> Rockstar having clearly failed management and a complete loss of control
That's both very broad and generic, and completely unfalsifiable, and comes with nothing backing it up. It's just an unsubstantiated opinion. These things are fine when drinking in friends, or otherwise socializing by bonding over ramblings.
If you want to convince someone of something, the standards of evidence (not to mention, clarity of thinking) are a bit higher.
>the company starts falling apart.
This site will start falling apart if we don't keep things civil.
I recently needed a lawyer on something that involved lots of highly sensitive PI.
Sending my file over to lawyers in a semi-safe way has proved impossible.
And in any case, i received an answer with lots of PI over a plain email…
Absolutely maddening
Why? I would assume encrypting and sending the key via a different channel would be sufficient. Or are lawyers still not technically apt to do so?
Then lawyer replies in plain email discussing those very things...
In France the french IRS leaked infos about the wealth of its citizens and evil thieves cross-checked it with leaks of people who ordered hardware wallet for cryptocurrencies and families are getting kidnapped and tortured. In a recent case three family members have been beaten over two days so that... 40 000 EUR could be stolen.
That's the world we live in.
"Police and thieves", collaborating one way or another (leaking data collected by big brother and then having big brother being very soft on crime is one way to collaborate with evil people), "to scare the nation with their guns and ammunition" (as in the reggae song).
As much as I don't like the cryptocurrency ecosystem, I don't think facilitating and encouraging kidnapping and torture is the way to go.
Shame on the french government.
Two sides of the same coin.
> There should be some consequences for companies […] retaining drivers licence photos after test driving a car, they just don't need the data anymore.
I know it’s modern American tech tradition to make fun of the GDPR, but this is genuinely one of the things it stipulates: You’ll get at least a slap on the wrist, or potentially much worse, if you needlessly keep data around longer than necessary to do the task you had collected it for in the first place.
I said it before as well, but it’s because nothing “publicly really bad” happened despite the leaks and stolen information over the past decades. After Equifax breach, everyone got tired, because company survived, and whatever identity theft happens from time to time gets swept under the rug. It didn’t impact most people’s lives, despite leaking half of the US’s SSNs and etc. Then fatigue kicked in, and with subsequent leaks everything just mellowed down, so nobody cares.
I’ve switched to operate with the idea that my information has already been leaked at some point. I should be generally ready to fix the problems if/when identity theft happens, rather than inconveniencing myself and figuring out the third party trust situation.
> I don't think [...] these companies [...] can be trusted with my data
Abusing privacy is the lucrative norm. The laws won't help you and the government is busy with its corporate agenda.
There’s nothing lucrative in abusing privacy, and yes the government is busy but it has nothing to do with a "corporate agenda", any government or any country with more than a few millions of people is busy, agenda or not.
> where I'm opposed to talking to my doctor because the information may be digitally recorded and leaked
Let me say "Hi mate, +1". State doctors? There are territories in which a pharmacological prescription is shared DB only now (where previously they could be on paper - a secret between you, the pen, the paper, the pharmacist and the gods). Private entities? Good luck finding one that does not require a privacy waiver as a condition for the visit. Searching for a medical dock (a dock for a doc), calling them to ask? "This is a recorded message. If you proceed with the call then you agree..." (Hang-up click).
I mean why does every hotel need to make a copy of my passport?
It is a basic police requirements on most countries. Hotels must collect visitor id's and keep it for several weeks.
Yeah, it's old-school people control. This said, these days it could be done electronically, without the hotel storing physical information: at check-in, you put your passport in goverment-issued, (hopefully) tamper-proof machines, the hotel confirms length of stay, police server gets the info and that's it; early checkouts, the hotel must notify via some web portal. It would be relatively easy to implement.
But nobody really cares enough to spend money modernising this sort of system.
I'm sure they're done electronically in some places: Your passport details are appended to the shared Google Spreadsheet...
I'm only half joking: I used to work in payments, hotels didn't care about PCI. Full card numbers stored everywhere.
I know, and that's really the thing: nobody cares, not the government and certainly not the hotels.
I don't think my at-the-time employer cared much, either :)
> This said, these days it could be done electronically
Are you 'avin a laugh mate?
A photocopy of my passport is going nowhere and is shreadded afterwards. An electronic copy..... God lord.
The GDPR also requires data deletion once you no longer need it; physical as well as electronic. This is common sense, and why some organisations don't do this is simply mind boglling.
The whole point is that the hotel would not even get a copy, the machine would just send hashes around and the hotel would only get an anonymous transaction ID to store. It would probably be even more secure than what you have today at the airport.
If you think photocopies kept in some folder accessible to anyone working in the hotel, with a promise to delete it at some point, is "secure" in any way, I don't know what to tell you.
All these giant data leaks are coming from the government's "tamper proof" systems!
I know, and it's really the trade-off whenever this sort of system is centralized: you can better secure the leafs, but the central repository becomes an even juicier target.
This said, the police already has a database with these info, and it likely is somehow already on the network, so adding an api (if done properly) would not dramatically alter the exposure profile.
I just tell them they can look at it but not copy it and that's satisfied them, for now. Sometimes had to get a manager in, but never had them deny me fully. I'm sure sooner or later I'll run into a stubborn one and have to scramble for a day-of replacement hotel, and that just adds to my list of reasons to avoid travel.
And why are politicians immune to all of this shit??
Why can’t WE spy on them 24/7?
Because you are a slave, Neo.
If democracy really worked, and your desire to spy on politicians is shared by enough people, supposedly, you should be able to create your own party which has that explicit goal. Maybe find a few other goals, or you will end up like the pirates :-)
I am writing this because I don't think democracy works as advertised.
I’m never going to a therapist after one company leaked all of the patient data / therapy notes for 33k patients.
It looks like you punish yourself unnecessarily, for things that are out of your control.
This is just a general American complaint that has merit on its own, but has nothing to do with the article and is just derailing any discussion about the article itself and driving the conversation to your own personal concerns about something completely separate.
In this case, the EU does have consequences for data breaches where proper protocols are not followed.
Additionally, this is not private information .. most anyone can look this information up. ID numbers are not confidential information like SSNs are treated in the US.. they are just a number to tell person A from person B. You give this number to everyone without thinking about it because it's how every company you interact with identifies you.
In this case a rogue company, or compromised company, used their access to contact the central database to download everyone's information.
In my country we essentially use the same system, except for we still allow companies to download the whole database if they want to instead of making individual queries.
In this case the access to their system was unauthorized, and under GDPR data breaches have to be reported within 72 hours. Companies can't make the decision on their own that it's not a big deal.
In Sweden, to avoid this kind of malicious leaks, we leak the residents' data officially. https://hitta.se lets you look up personal numbers, names, addresses, birthdays and sometimes phone numbers of any resident. The residents are not asked for consent, the data goes there automatically (some of my friends had success with having it removed from hitta, but it comes back once you change residence address).
It's quite convenient, when you meet a new friend, to go and check what neighbourhood they're from, who do they live with and where they lived before.
What's the big deal, Danes? What do you have to hide?
(The provocative tone is intentional as a joke, I'm not even a Swede, I just find the brotherly rivalry between Scandinavians amusing.)
Are there no murderers, crazy ex-boy/girlfriends, targeted harrassment and spam calls in Sweden?
Not that any other country does much better in this regard. Still it sounds a little wild to me that you can get this information without even needing to hit a shady forum and download some csv. Maybe lowers the bar too much.
I've been told back in the day it was quite normal get a physical, dead-tree book with similar information sent out to you every year, until people decided that was a waste of paper.
It used to be illegal here to reverse look up a name matching to a phone number, since it was "owned" by the state telephone company and they didn't want that happening. But you were allowed to reverse look up the address of a number and then look up the person and match it to the number. So that magic happened under the hood. The trick was getting the residential information but since that wasn't a problem in the '90s I'm sure it is even less of an issue now.
Yes, it is possible to have a protected identity.
It seems that you can have a protected address in Denmark as well. Apparently, the protected address is even a field in the current leak.
There are. You can get a protected identity if you have that issue.
The current system has been in place around 1770. There's some pushback against it the last few years.
I have been advocating for Denmark to do the same for 15+ years. The fact that your social security number can be used for anything on it's own is a disaster. Mostly it can't anymore, because you have to do electronic signing with MitID, but it's still considered secret. If you own a home in Denmark, address information is already public, but a little hard to lookup.
The problem with this leak mostly going to be those with hidden addresses or secret phone numbers. Last time something similar happened was when it was shown that you could pretty much just guess a persons social CPR number if you had their birthday. Normally you could narrow it down to 6 or 8 possible numbers then use the phone companies websites, pretend to create a new account, enter the CPR number and check if you guessed correctly. Because the demo was done with politicians, then phone companies no longer ask for CPR upfront.
>Because the demo was done with politicians
I feel like this should be the default. Responsible disclosure to the affected company, followed immediately by disclosure to every politician in the dataset. Once we start collecting high profile cases this way instead of waiting X days for a faceless corporation to release a fix, companies will think twice about their security and the data they collect if that could make them end up on the shit list of the local government.
I was actually surprised when I heard about this for the first time. Also I've heard that even the salaries of people are publically available. That's really cool.
This probably improves economic efficiency a lot. Want to build something and remember meeting a relevant expert 3 years ago at a party? Easy to find that person and start doing business...
Yes, it's great for businesses, you can search for the cheapest labor, and helps you avoid paying someone much more than they previously earned.
You do have to request them and the person you requested them for will know you did so
It will be registered if you ask Skatteverket directly, but if you go via a company (i.e.: Eniro), the subject does not get to know it.
Personal numbers are not available from hitta.se.
Not in full as it doesn't have the last 4 partly random digits, though personal numbers aren't that useful even if it was the full one.
Wait... wait wait... I thought the EU "protection" laws was supposed to prevent all of this?
Just that easily all the private conversations of everybody in the EU can leak if Denmark succeeds at outlawing E2E encryption with its Chat Control proposal.
Not trying to downplay the situation, but I hope this will be eye opening to the responsible people.
Unfortunately, for the people who strongly believe that Chat Control is the way, they will use these types of events as further evidence as to why spying on everyone is the best deterrent.
I heavily doubt these people are open to self-criticism in any way. They have their program and are set to implement it.
For those not getting the scope of this. The following has been compromised for all living danish citizens and foreign nationals which have had recidence. And quite a few dead ones as well.
- Social security number
- Age
- Sex
- Family relations
- Physical address
- Protected addresses
- Sex change
This is a country with quite good health records. Unfortunately also previous problems with proper non-reversible anonymisation of said data when used for research.
Where did you get that from? All I saw was: names, addresses and CPR numbers.
Additionally it was via third party access granted to private companies.
https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfatt...
CPR number contains Age and Sex. It's date of birt DD MM YY. Plus four digits where you can read the sex from. I think it's even vs uneven numbers.
It's honestly worse. DDMMYYY (the last Y is from a lookup table to know if it's 18YY, 19YY or 20YY). If a person is born before October 2007 you can even do a checksum using the last digits to verify using the last digits. And yes, last digit is an even number for women, and uneven for men.
In Finland, this would be enough to get you through the security checks at pretty much any institute via phone, possibly excluding banks.
I think it is worth mentioning that age and sex is encoded in the social security number.
There are exceptions where the encoded birth date will be wrong (like immigrants with unknown birth dates) or dates where there are more people than the 4 digits that encode checksum validation and gender can handle.
I learned a few days ago from a friend, when this was reported in the Danish media, that the "random" part is only 4 digits and as a bonus is sequential. So if you register in the country as foreign citizens together with your partner those are likely sequential.
Then again, in my country some municipalities handed out numbers starting with your birth year....
A good time to remember that cramming data into your identifiers will come back to bite you... It hasn't really been necessary since databases replaced library catalogs anyway.
I think they do this to make it easier to remember your number. It’s really not private data in the Nordics as others mentioned, even your address and phone number and , on request, salary can be easily found out legally.
They say that persons with protected address had not been leaked.
What's a protected address, witness relocation programs...?
When you change your address you can click a checkbox saying you want a protected name/address. This means that companies that have you as customers/clients won't be able to get the new address, mail won't be redirected, etc
I did it accidentally during my last move and it was a pain in the behind
And it expires after a year by default so it feels rather pointless
You can just apply for protected address. I did that once, because I did not want that my .dk domains whois would show my name and address.
I managed to get protected address, it's just to log in somewhere and request it. I can't remember the details, but it made for example banking _slightly_ more annoying. They would call me so they can send me a letter. Also makes it harder for people who know your name to look up your address.
Never managed to get my name removed from my domain whois and at some point removed protected address again. In theory, if I share one of my other .com domains on the internet, an attacker could reverse DNS the IP, find my DK domain and thus get my full name and address.
Nobody knows exactly what was accessed. What you have listed is what the register contains, not what was accessed. People with "Protected addresses" have specifically not been compromised.
As someone who spend a decade in the Danish public sector, among other things working in groups on national architecture. I'd say that we reap what we sow. IT and digitalisation is not taken very serious in our public sector. In most places it's placed under something, and until recently it didn't have it's own ministry. Right now it's even a shared ministry, and there is little focus on cyber security. What has arrived in recent years is solely based on the thread of hybrid attacks from Russia.
Compare this to the ministry of transportation, which has full resources. This is despite the fact that most people in this country spend less time commuting than they do working on a computer. Not that transportation isn't important, but maybe digitalisation is as well?
My personal CPR has been leaked a couple of times though. Hilariously the first time it was leaked when a couple of unencrypted laptops were stolen from the biggest IT union in the country. We have a system in place where you can flag your CPR as having been leaked. Though I suppose now we might as well consider every one of them to be leaked. In theory a CPR on it's own was never meant to give any sort of authority or access, but again, this wasn't the practice in a lot of place. So I guess this leak may be a blessing in disguise in that sense as well, as it'll highten security because of broken trust.
> IT and digitalisation is not taken very serious in our public sector.
I think I get what you are trying to say, but just for other people reading this: Denmark is one of the "best" / advanced countries when it comes to IT and digitalisation in public sector in Europe.
Another Dane here, and that is absolutely not true. Where's your source to back up this claim? (I'll show you mine if you show me yours)
Maybe 10 years ago, but other nations have caught up. Italy has their Sistema di Interscambio. Germany and France have taken digital sovereignty serious. Spain is big on open source (and ruby for some reason). Estonia has been miles ahead for more than 10 years. It's true that we have some ease of use systems compared to most of Europe, but we also have a lot of horror stories.
That being said it's not like us being shit at cyber security doesn't mean other countries aren't also shit. Look at Australia getting hacked by AI. I know it's all the rage to blame OpenAI, but really, shouldn't Australia count itself fortunate it wasn't an enemy nation state? Or that their lacking security got exposed before it was.
You're conflating two different things here. What Denmarks excels at it implementing public IT solutions that makes processes smoother, like patient records, medical perscriptions, digital signature, a nation-wide digital identity, things like that. Digital sovereignty isn't part of this, and Denmark isn't particularly good at it, nor is it really valued that highly. Same for cyber security, I'd say that it's down to dumb luck that it's not worse. There is a city, Randers, they can't send email to the domain anders.dk (Anders being a pretty normal Danish name). Why? Because the butterfingered public employees in Randers could stop sending personal information about citizen to anders.dk, which has a catch-all email. They simply forgot the "r". The problem is the lax attitude to emailing sensitive information, probably via a Microsoft run Exchange server, but rather than fixing that, they just blocked the anders.dk domain.
Mhh, I don't know. In Germany they proudly proclaimed their BAföG / Student loans (SU in Denmark) is now digital. But what was digital was just the client side, on the government agency side they still would print out the applications. And because they where used to people sending in paper, they had to hire more people to help with the printing. AHHHHH. That is the state of German digitalisation.
There are things I wish I could change in Denmark, mainly the power sockets and number system (Base 20 what the heck?) but Denmark is on a good course when it comes to IT understanding. Both the broader society and government implementations.
Yes yes, Estonia is better. But Denmark is still doing good.
Can't speak for the Danish govt in general, but you should look up the history of the property tax scandal and the projects that tried to fix it. I was part of the third attempt to rectify the problem at SKAT.
Or how there still are over 200 people working fulltime on the corona mink .. "event"
That said, compared to other countries the tax / SKAT is also quite decent.
The article mentions that they accessed the information through a Danish company whose access has been revoked now. I find it really surprising that a company could access these records without any limitations on which info or how many records they can pull.
In the past few months, there were several huge data leaks also:
- in Poland (from private medical companies used by doctors) with estimated 20M affected people (half of population)
- in France (from tax office), 678k people affected
With AI getting more capable, and with Russia escalating things, I unfortunately expect more to come.
Gun ownership records were leaked in france recently too, including identity and address.
Denmark's population is 6 million [0], where does the diff of 2.8M come from? :)
[0] https://www.dst.dk/en/Statistik/emner/borgere/befolkning/bef...
Answering my own question, from here[0]: 'approximately 8.8 million registered persons (living, departed, deceased, etc.)'
[0] https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfatt...
It's explained in the article, the dataset includes foreign nationals/temporary residents and some deceased people as well.
If people don't go to jail, there will be no change.
The EU would rather destroy our right to privacy than hold criminals accountable. If I sound bitter it's because I have become very bitter over the last decade. The EU appears very effective at picking on individuals and people who can't fight back, and absolutely toothless when it comes to taking on more powerful interests. There are very few cases of the EU tangibly improving my life over the last decade, and countless examples of making it worse.
Problem is that the EU will even go further here and tries to implement that everyone is forced to id themselves despite the regular problems.
> If people don't go to jail, there will be no change.
The EU being the EU, it's those criticizing the leak by governments of public data that are going to be sent to jail.
CPR is the national register of all people (Central Person Register).
CPR is the administrator. There is more information in the linked press release from the ministry:
https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfatt...
This is a huge headline story in Denmark today and I choose to link danish content as they are the primary source.
The only current english language sources are paywalled:
https://www.thelocal.dk/20261005/hackers-get-personal-info-o...
https://www.bloomberg.com/news/articles/2026-10-05/denmark-d...
Non-paywalled but major danish news outlet (National Brodcaster):
https://www.dr.dk/nyheder/indland/live-uvedkommende-har-haft...
Another non-paywalled English article from a Danish source: https://cphpost.dk/2026-10-05/life-in-denmark/cpr-data-breac...
Will they be fined? (Probably not)
Will Danes be compensated for the hassle, this causes them? (Probably not)
Will Danes be hassled with GDPR-compliance in every business, school etc. even though the state can't keep records safe? (Probably yes)
Just so everyone understands the numbers thats basically everyone in Denmark.
Everyone in Denmark dead or alive... I wonder how many years or decades it takes to clean up the dead from there.
You are right lol, damn!
yeah, a this rate, we can assume all digital information will be public at some point.
As someone who works with CPR data in Denmark, this does not surprise me at all. Private companies access the data through an API, and anyone who works at such a company can look up CPR data as they please.
And guess who are pushing for the Chat Control.
Isn't that more than the current population of Denmark? Who were the other exposed people?
Foreign residents and dead people, apparently.
"Something is rotten in the state of Denmark"
Altman at it again?
Let me guess, the Danish government will find a way to prove that GDPR doesn't apply to them.
But this is incredibly bad.
It does apply but they were allowed to have this data and GDPR does very little to protect it in that case.
I am so done, my cpr is leaked oh no. Like I don't
This is were security meets the real world. The number is not secret but people have been taught to keep it confidential. And when you know the last 4 digits social engineering har become a lot easier.
On positive side maybe now there is no reason to use it for authentication anymore. When it was always unsuitable for that reason.
I used to agree.
But since then I have experienced how scared mugglers get when they get a threatning mail with the only legitimacy of naming and old leaked password.
This will be easy to exploit on a scale.
Scammers used to prey on the weakest hence the many Nigerian Princes. But as they get more sophisticated and move up the chain they start to look more and more legitimate.
CPR isn't the problem, the rest of it is.
it feels this will keep happening specifically to Europe for three reasons: a) most countries took an anti-AI approach b) they reject frontier models in favor or "Sovereign" solutions c) they're replacing software with weaker/more vulnerable options
public servant engineers are token poor and will be out of the latest defense tools
I don't think this is AI related at all. What makes you say that?