For those not getting the scope of this. The following has been compromised for all living danish citizens and foreign nationals which have had recidence. And quite a few dead ones as well.

- Social security number

- Age

- Sex

- Family relations

- Physical address

- Protected addresses

- Sex change

This is a country with quite good health records. Unfortunately also previous problems with proper non-reversible anonymisation of said data when used for research.

▲ kasperni 11 hours ago | parent | next [-]

Nobody knows exactly what was accessed. What you have listed is what the register contains, not what was accessed. People with "Protected addresses" have specifically not been compromised.

	▲	clan 7 hours ago \| parent [-]
		That is not what I have heard. AFAIK those with protected addresses has not had their address compromised. But ID and name still is. And with the rest exposed it is now trivial to see what adresses are "interesting".

▲ deanc 9 hours ago | parent | prev | next [-]

In Finland, this would be enough to get you through the security checks at pretty much any institute via phone, possibly excluding banks.

▲

nottorp 5 hours ago | parent [-]

Finland uses whatever the equivalent of a SSN is as a password, US style?

	▲	deanc 3 hours ago \| parent [-]
		Kind of. It's advised to keep it secret but I'd be astonished if most people haven't had it leaked whether they realise it or not. Usually when identifying with e.g. a telecoms provider you would give your SSN and then some additional piece of meta-data such as address. Chances are everyone has a combination of SSN + address + phone leaked.

▲ delamon 11 hours ago | parent | prev | next [-]

They say that persons with protected address had not been leaked.

▲ toyg 11 hours ago | parent [-]

What's a protected address, witness relocation programs...?

▲ LarsKrimi 10 hours ago | parent | next [-]

When you change your address you can click a checkbox saying you want a protected name/address. This means that companies that have you as customers/clients won't be able to get the new address, mail won't be redirected, etc

I did it accidentally during my last move and it was a pain in the behind

And it expires after a year by default so it feels rather pointless

	▲	encom 5 hours ago \| parent [-]
		If you own a danish domain name (.dk), unless you have protected address, all your info is a whois lookup away. Example lookup of ft.dk (danish folketing). `Domain: ft.dk DNS: ft.dk Registered: 1995-07-04 Expires: 2027-09-30 Registration period: 1 year VID: no DNSSEC: Signed delegation Status: Active Registrant Handle: DATA REDACTED Name: Folketinget Address: Christiansborg Slot 1 Postalcode: 1218 City: København K Country: DK Phone: +4533375500 Email: webmaster@ft.dk ID status: ID verified via electronic ID Nameservers Hostname: maleah.ns.cloudflare.com Hostname: yichun.ns.cloudflare.com` This is why I've never posted anything from my own shitty website here. All of this is available from [myname].dk with my info on it. Also it's horrifying that our government is restricting access to its website behind fucking CloudFlare. EDIT: I didn't redact anything from the lookup, this is the exact data I received.

▲ Mashimo 10 hours ago | parent | prev [-]

You can just apply for protected address. I did that once, because I did not want that my .dk domains whois would show my name and address.

I managed to get protected address, it's just to log in somewhere and request it. I can't remember the details, but it made for example banking _slightly_ more annoying. They would call me so they can send me a letter. Also makes it harder for people who know your name to look up your address.

Never managed to get my name removed from my domain whois and at some point removed protected address again. In theory, if I share one of my other .com domains on the internet, an attacker could reverse DNS the IP, find my DK domain and thus get my full name and address.

▲ wodenokoto 11 hours ago | parent | prev | next [-]

I think it is worth mentioning that age and sex is encoded in the social security number.

There are exceptions where the encoded birth date will be wrong (like immigrants with unknown birth dates) or dates where there are more people than the 4 digits that encode checksum validation and gender can handle.

▲

consp 9 hours ago | parent | next [-]

I learned a few days ago from a friend, when the other leak at the university was reported in the Danish media, that the "random" part is only 4 digits and as a bonus is sequential. So if you register in the country as foreign citizens together with your partner those are likely sequential.

Then again, in my country some municipalities handed out numbers starting with your birth year....

▲

vintermann 10 hours ago | parent | prev [-]

A good time to remember that cramming data into your identifiers will come back to bite you... It hasn't really been necessary since databases replaced library catalogs anyway.

	▲	brabel 9 hours ago \| parent [-]
		I think they do this to make it easier to remember your number. It’s really not private data in the Nordics as others mentioned, even your address and phone number and , on request, salary can be easily found out legally.

▲ guytv 7 hours ago | parent | prev | next [-]

this is gold to countries that routinely fake other countries passports for "legends" (cover identities) for their intelligence officers working in "target countries".

▲ IceDane 8 hours ago | parent | prev | next [-]

This is just wrong and should be flagged by mods. It's name, CPR and address.

Gender is encoded in the CPR number.

▲ vasusai 11 hours ago | parent | prev [-]

[dead]

▲

Mashimo 11 hours ago | parent [-]

CPR number contains Age and Sex. It's date of birt DD MM YY. Plus four digits where you can read the sex from. I think it's even vs uneven numbers.

▲

mrweasel 10 hours ago | parent [-]

It's honestly worse. DDMMYYY (the last Y is from a lookup table to know if it's 18YY, 19YY or 20YY). If a person is born before October 2007 you can even do a checksum using the last digits to verify that the number is "correct" (not necessarily in use). And yes, last digit is an even number for women, and uneven for men.

▲

jjgreen 9 hours ago | parent [-]

.. decimal place for interestingly gendered?

	▲	mrweasel 8 hours ago \| parent [-]
		I think you get to pick even or uneven yourself if you're don't identify as male or female and you can have a new CPR if you change gender. There is some interesting details that may require you to change your name, if you want the last digit changed. That means if you're name is Kurt, you can't have a CPR number ending in an even number, because Kurt is only an approved name for men. If your name is Kim, Storm, Charlie, Orla, Lykke or some other unisex name it's not a problem.