Comment by clan
17 hours ago
For those not getting the scope of this. The following has been compromised for all living danish citizens and foreign nationals which have had recidence. And quite a few dead ones as well.
- Social security number
- Age
- Sex
- Family relations
- Physical address
- Protected addresses
- Sex change
This is a country with quite good health records. Unfortunately also previous problems with proper non-reversible anonymisation of said data when used for research.
Nobody knows exactly what was accessed. What you have listed is what the register contains, not what was accessed. People with "Protected addresses" have specifically not been compromised.
That is not what I have heard.
AFAIK those with protected addresses has not had their address compromised. But ID and name still is.
And with the rest exposed it is now trivial to see what adresses are "interesting".
In Finland, this would be enough to get you through the security checks at pretty much any institute via phone, possibly excluding banks.
Finland uses whatever the equivalent of a SSN is as a password, US style?
Kind of. It's advised to keep it secret but I'd be astonished if most people haven't had it leaked whether they realise it or not. Usually when identifying with e.g. a telecoms provider you would give your SSN and then some additional piece of meta-data such as address. Chances are everyone has a combination of SSN + address + phone leaked.
They say that persons with protected address had not been leaked.
What's a protected address, witness relocation programs...?
When you change your address you can click a checkbox saying you want a protected name/address. This means that companies that have you as customers/clients won't be able to get the new address, mail won't be redirected, etc
I did it accidentally during my last move and it was a pain in the behind
And it expires after a year by default so it feels rather pointless
1 reply →
You can just apply for protected address. I did that once, because I did not want that my .dk domains whois would show my name and address.
I managed to get protected address, it's just to log in somewhere and request it. I can't remember the details, but it made for example banking _slightly_ more annoying. They would call me so they can send me a letter. Also makes it harder for people who know your name to look up your address.
Never managed to get my name removed from my domain whois and at some point removed protected address again. In theory, if I share one of my other .com domains on the internet, an attacker could reverse DNS the IP, find my DK domain and thus get my full name and address.
I think it is worth mentioning that age and sex is encoded in the social security number.
There are exceptions where the encoded birth date will be wrong (like immigrants with unknown birth dates) or dates where there are more people than the 4 digits that encode checksum validation and gender can handle.
I learned a few days ago from a friend, when the other leak at the university was reported in the Danish media, that the "random" part is only 4 digits and as a bonus is sequential. So if you register in the country as foreign citizens together with your partner those are likely sequential.
Then again, in my country some municipalities handed out numbers starting with your birth year....
A good time to remember that cramming data into your identifiers will come back to bite you... It hasn't really been necessary since databases replaced library catalogs anyway.
I think they do this to make it easier to remember your number. It’s really not private data in the Nordics as others mentioned, even your address and phone number and , on request, salary can be easily found out legally.
this is gold to countries that routinely fake other countries passports for "legends" (cover identities) for their intelligence officers working in "target countries".
This is just wrong and should be flagged by mods. It's name, CPR and address.
Gender is encoded in the CPR number.
[dead]
CPR number contains Age and Sex. It's date of birt DD MM YY. Plus four digits where you can read the sex from. I think it's even vs uneven numbers.
It's honestly worse. DDMMYYY (the last Y is from a lookup table to know if it's 18YY, 19YY or 20YY). If a person is born before October 2007 you can even do a checksum using the last digits to verify that the number is "correct" (not necessarily in use). And yes, last digit is an even number for women, and uneven for men.
2 replies →