As someone who works with CPR data in Denmark, this does not surprise me at all. Private companies access the data through an API, and anyone who works at such a company can look up CPR data as they please.

That is also my impression. So I wonder how they caught this. It will be interesting if they are going to say so at some point.