Data Leak – Skatteforvaltningen (TastSelv Borger / DXC Technology)

A software defect in the public self-service system TastSelv Borger placed citizens' CPR numbers inside URLs, which were then transmitted to Google and Adobe as part of ordinary web requests. The defect triggered when a citizen logged in and used "Ret kontaktoplysninger".

Approximately 1.26 million citizens were affected. The leak ran from 2 February 2015 to 24 January 2020 — nearly five years — before it was discovered on 21 January 2020 by Udviklings- og Forenklingsstyrelsen during an inspection of the system, which was operated by DXC Technology (the former CSC).

Not an attack, and included here for that reason: it is the largest Danish CPR exposure of the period, and it happened through a mundane referrer-leak pattern in a system nobody was attacking. Udviklings- og Forenklingsstyrelsen assessed that the data was not misused.

• TV 2 — 1,2 millioner cpr-numre lækket ved en fejl
• DR — 1,2 millioner danskere har fået cpr-numre lækket
• Version2 — DXC har lækket over 1,2 mio. borgeres cpr-numre i web-adresser
• Version2 — Data-læk fra TastSelv: DXC sendte 3300 CPR-numre til amerikansk leverandør