this post was submitted on 05 Oct 2026
112 points (99.1% liked)

Europe

12231 readers
716 users here now

News and information from Europe 🇪🇺

(Current banner: La Mancha, Spain. Feel free to post submissions for banner images.)

Rules

  1. This is an English-language community. Comments should be in English. Posts can link to non-English news sources when providing a full-text translation in the post description. Automated translations are fine, as long as they don't overly distort the content.
  2. No links to misinformation or commercial advertising. When you post outdated/historic articles, add the year of publication to the post title. Infographics must include a source and a year of creation; if possible, also provide a link to the source.
  3. Be kind to each other, and argue in good faith. Don't post direct insults nor disrespectful and condescending comments. Don't troll nor incite hatred. Don't look for novel argumentation strategies at Wikipedia's List of fallacies.
  4. No bigotry, sexism, racism, antisemitism, islamophobia, dehumanization of minorities, or glorification of National Socialism. We follow German law; don't question the statehood of Israel.
  5. Be the signal, not the noise: Strive to post insightful comments. Add "/s" when you're being sarcastic (and don't use it to break rule no. 3).
  6. If you link to paywalled information, please provide also a link to a freely available archived version. Alternatively, try to find a different source.
  7. Light-hearted content, memes, and posts about your European everyday belong in other communities.
  8. Don't evade bans. If we notice ban evasion, that will result in a permanent ban for all the accounts we can associate with you.
  9. No posts linking to speculative reporting about ongoing events with unclear backgrounds. Please wait at least 12 hours. (E.g., do not post breathless reporting on an ongoing terror attack.)
  10. Always provide context with posts: Don't post uncontextualized images or videos, and don't start discussions without giving some context first.

(This list may get expanded as necessary.)

Posts that link to the following sources will be removed

Unless they're the only sources, please also avoid The Sun, Daily Mail, any "thinktank" type organization, and non-Lemmy social media (incl. Substack). Don't link to Twitter directly, instead use xcancel.com. For Reddit, use old:reddit:com

(Lists may get expanded as necessary.)

Ban lengths, etc.

We will use some leeway to decide whether to remove a comment.

If need be, there are also bans: 3 days for lighter offenses, 7 or 14 days for bigger offenses, and permanent bans for people who don't show any willingness to participate productively. If we think the ban reason is obvious, we may not specifically write to you.

If you want to protest a removal or ban, feel free to write privately to the admin that applied the rule (check modlog first to find who was it.)

founded 2 years ago
MODERATORS
 

Denmark has confirmed a major data breach involving its Central Population Register, known as CPR, after unauthorized parties accessed personal records belonging to about 8.8 million people. The exposed information includes names, addresses, and CPR numbers, according to an official statement published on October 5, 2026.

The figure exceeds Denmark’s population of roughly six million because the register also holds records of people who have moved abroad and those who have died. Officials said the CPR system currently contains approximately 11 million registered people, meaning the incident affected a large share of its records.

...

The attackers misused a private Danish company’s lawful access to search the CPR system during September. Authorities have not described how the unauthorized parties obtained or used that access, leaving the initial entry method unknown.

The confirmed route is important: this was misuse of an approved company connection, not a publicly confirmed software flaw in the register. The ministry has not disclosed the company’s name, linked the incident to a known threat group, or identified a specific vulnerability.

...

Research, Education and Digitalization Minister Christina Egelund described the incident as deeply serious. She informed Parliament’s Business and Digitalization Committee and requested a thorough security review of CPR. Officials said preventive measures had already started, without detailing their technical scope.

...

Names, addresses, and national identification numbers can make fraudulent messages and calls appear convincing. Cybersecurity News’ coverage of the Pentagon data breach similarly highlights the risks when personal records include identity numbers, while its phishing prevention guidance explains common warning signs.

...

Archived

you are viewing a single comment's thread
view the rest of the comments
[–] Ontimp@feddit.org 8 points 2 weeks ago* (last edited 2 weeks ago) (4 children)

Haha I work in German government IT and have a colleague who likes to point to Denmark as an example for how good things could be here. I'll show him this next time he needs to put down the rose glasses.

That said, it's the same in Germany, only that citizen data is kept with municipalities, so we have ca. 11.000 different such shitty systems built decades ago instead of one - which makes it less attractive and damaging to compromise any given one, I guess.

At least, however, we don't have a citizen ID such as the one you describe, that could be used to identify people uniquely.

[–] helix@feddit.org 2 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

we don’t have a citizen ID

OK, so you forgot the Sozialversicherungsnummer and the Steuer-ID?

[–] Ontimp@feddit.org 3 points 1 week ago

They are not really the same though. These are domain specific identities. Sure, the tax office has your tax ID. But your municipality, the state health authorities or the retirement insurance will never ask you your tax ID, don't have access to it and are not allowed to process it. It's not a citizen ID that can be used to link different data sets and it's not saved in the Melderegister.

[–] theoretiker@feddit.org 2 points 1 week ago

With NOOTS Germany will move toward a less decentralized service with municipalities being able to share data between them more easily. I hope though that BSI pressures for it to be secure by modern standards.

[–] SorteKanin@feddit.dk 1 points 2 weeks ago (1 children)

At least, however, we don’t have a citizen ID such as the one you describe, that could be used to identify people uniquely.

Oh don't get me wrong, there is nothing wrong with a citizen ID. Actually a citizen ID is very useful. It should just only be an ID and shouldn't give any access.

[–] Ontimp@feddit.org 5 points 1 week ago

Depends how much you trust the state. After the Nazi period, the German state is actually not allowed to keep persistent identifiers on people. You can only identify any. given citizen through a domain ID that may not be shared or used beyond a specific domain (e.g tax ID) or a combination of changeable attributes (address, name, etc.).

In practice this can be annoying, but it's also a useful precaution to prevent the government form easily pooling and linking information on citizens across domains and levels of state.

[–] RichieRich@lemmy.world 1 points 1 week ago (1 children)

If you were to combine those two pieces of information, you could definitely identify a person unambiguously. Just because our government is too incompetent to combine the information doesn’t mean hackers won’t do it. But soon we’ll have the centralized BundID—to make things easier for hackers.

[–] Ontimp@feddit.org 2 points 1 week ago* (last edited 1 week ago)

I know and what I'm sayin is that this is by design. It's not only about competence, competence can be bought. It's structurally difficult because various different ministries and independent bureaucracies would need to decide to cooperate and do tedious work to combine data sets like this. It's not a magical antidote but a structural impedance that is supposed to make abuse more difficult, obviously not impossible.

And BundID does not entirely change to his. BundID does not assign you a unique identifier either. You get a temporary process-based ID that is generated as you apply for a government service and that is forwarded throughout the process. BundID itself only has a basic user name that you pick yourself and that is not used or stored anywhere outside it. The actual authentication is done via the eID, Elster certificate, etc. which all don't leave cryptographic traces.

Don't get me wrong, this system is still kind of broken. BundID still bundles important information in a central location and urgently needs modernization. And it's authentication amounts to 'trust me bro' from the POV of any other government service. But it does not introduce a global unique identifier either.