Hacking – CSC Danmark (Rigspolitiet)

From April to August 2012, attackers had persistent access to mainframe systems operated by CSC Danmark, which hosted central registers on behalf of Rigspolitiet. Over roughly five months they downloaded data from the police driving-licence register — including approximately 91,000 CPR numbers — and from the Schengen Information System register of wanted persons.

The case is still routinely referred to as Denmark's largest hacking case. What made it consequential was less the intrusion itself than the detection failure around it: Rigspolitiet was warned by Deloitte about security weaknesses at CSC in June 2012, received indicators from Swedish police in September 2012 and again in January 2013, and did not review that material until late February 2013. The vulnerability was not closed until 10 March 2013 — roughly seven months after the attackers had already stopped, because Gottfrid Svartholm Warg had been arrested in Cambodia.

Both defendants were convicted on 30 October 2014. Warg received three and a half years.

• Retsudvalget — Hackerangreb mod CSC under optrævling (Folketinget, bilag)
• DR — Politiets kørekortregister er blevet hacket
• Version2 — Rigspolitiet: Kørekort-register hos CSC er blevet hacket
• Ingeniøren — Krav om indgreb efter hacking af CSC
• TV 2 — CSC-hacking stoppede, da super-hacker blev anholdt
• TV 2 — Svensker og dansker kendt skyldige i Danmarks største hacker-sag
• DR — Begge tiltalte i CSC-hackersag kendt skyldige
• Version2 — Dokumentation: Her er domsafsigelsen i hackersagen