When a message knows a person’s full name, home address and national ID number, most people conclude that it comes from someone who is entitled to know them. After a leak, that conclusion is wrong, and it is the one scammers rely on. This article uses the October 2026 incident in Denmark’s population register to explain why accurate details are no longer evidence, and which signs still are.
Background
On 5 October 2026 the administration of Denmark’s Central Person Register (CPR) said that unauthorised parties had obtained the names, addresses and CPR numbers of about 8.8 million people by misusing a private company’s legitimate access [1]. People who had registered name and address protection were not included [1]. Help Net Security reports that the group covers current residents, deceased people and citizens living abroad, roughly four fifths of the register’s 11 million records [2].
The data is identifying, not secret in the way a password is. It is the sort of detail that organisations use to prove that a caller is who they say they are. Once it is in someone else’s hands, the proof works for the wrong person. The Danish notice does not say that accounts were opened or money was moved [1].
Findings
Help Net Security reports that citizens are advised never to share passwords or confidential information by phone or e-mail, “even if the recipient apparently knows your name, address and CPR number” [2]. The same advice applies anywhere an ID number has leaked: knowing the number is not a credential.
What does separate a real message from a scam is how it behaves. The UK National Cyber Security Centre lists five signs that scammers use to push people into acting [3]:
| Sign | What the NCSC says criminals do | How a leak sharpens it |
|---|---|---|
| Authority | They pretend to be important people or organisations to trick you into doing what they want. | A correct ID number makes “your national registry” or “your bank” sound genuine. |
| Urgency | They threaten you with fines or other negative consequences. | “Your record is flagged, confirm today” arrives with the right personal details attached. |
| Emotion | They use threatening language, make false claims of support, or tease you into wanting to find out more. | A message that knows your address feels personal, which raises the pressure. |
| Scarcity | Fear of missing out on a good deal or opportunity can make you respond quickly. | “A refund is waiting for this address” uses the leaked address as bait. |
| Current events | They exploit current news stories, big events or specific times of year. | The breach itself becomes the story: “because of the register leak, verify your data”. |
The table’s middle column is the NCSC’s description of the signs, paraphrased closely from its page, which was last reviewed on 5 September 2022 [3]. The right-hand column is our reading of how those signs combine with leaked details, not a finding from the sources.
What to do
For a message that you did not expect, the NCSC’s advice is to “contact the organisation directly” and not to use the numbers or address in the message, but the details from the organisation’s official website [3].
- Treat every message that quotes your ID number as unverified, however accurate the details are.
- Do not reply, click or call back using anything in the message.
- Find the organisation’s contact details yourself and ask it whether the message was real.
- Never enter a password or approve a sign-in prompt because the sender knows personal details.
- Download software only from its official source, and be wary of any “update” that arrives by message.
- Follow the authority’s own announcements about the breach rather than links that arrive in messages.
Limits
- The Danish notice does not name the supplier, say how its access was obtained, or say whether the data has been published or sold [1]. We do not know how it is being used.
- The NCSC page is general guidance written in 2022. It is not about this incident.
- Reading a message correctly lowers the risk of being scammed. It does not undo a leak: an ID number cannot be changed like a password.
- A firewall on a Mac sees which app connects where. It cannot see whether a message that reached you is true.
How FireAI and HisnLabs fit in
A scam message that gets someone to install a fake app still needs that app to connect out. FireAI asks before a newly installed app reaches the internet, so the first connection is the user’s decision. It does not stop scam messages from arriving.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its FireAI Pilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.