Breach of Denmark's National ID System Demonstrates the Risks of a 'Papers, Please' Society

Centralized databases and national ID systems make tempting targets.

Like most of the rest of the world, the United States has been stumbling its way towards a "papers, please" society in which we must show identification to go about our lives. The latest excuse for imposing a national ID requirement is voting, with the stalled SAVE America Act intended to preempt state procedures by requiring people to show REAL ID-compliant documents before casting ballots. Whatever the excuse, we're told identification requirements will make us more secure, but a recent breach of Denmark's national ID system suggests that such an apparatus is just easy hacker bait.

---

Hackers 'Harvest Records on Approximately 8.8 Million People'

"Denmark is reviewing security controls around its national citizen registry after unauthorized parties exploited a company's access credentials to harvest records on approximately 8.8 million people over a 10-day period," Shweta Sharma of CSO, an enterprise-level security publication, reported earlier this month. "The breach covers people living in Denmark as well as individuals who have died or moved abroad, while people with protected names and addresses were not affected."

The hacker who broke into Denmark's Central Register of Persons (CPR) claims to have entered through a company with access that used "123456" as a password. Danish authorities are scrambling to reassess their security procedures, the implications of the lost data on what seems to constitute almost the entire population, and "whether there may be similar vulnerabilities in other key public IT systems."

It's tempting to marvel at the risks inherent in compiling a database of the identifying details of a country's people and then protecting it with the crappiest conceivable password. But Americans are in a poor position to savor the Danish government's discomfort (though we should sympathize with the concerns of the Danish people) given our own government's comparable screwups.

---

The U.S. Government's History of Data Breaches

In 2015, the federal Office of Personnel Management (OPM) suffered a massive data breach at the hands of Chinese government hackers. The OPM initially put the loss from the penetration of its background investigation databases on 4 million individuals. Later, though, after a second incident, the OPM raised its estimate to 21.5 million people whose "residency and educational history; employment history; information about immediate family and other personal and business acquaintances; health, criminal and financial history; and other details" had been surrendered to hackers.

That breach cast a long shadow. Government-provided credit monitoring and identity theft protection insurance for the affected individuals just began expiring earlier this year.

Frankly, compared to the scale of the OPM data loss, the slightly earlier incident at the Internal Revenue Service (IRS) involving the theft of Social Security numbers, birthdates, and home addresses of approximately 100,000 people almost doesn't register.

---

The Inherent Vulnerability of Centralized Databases

A year before those hackers engaged in one-stop information shopping courtesy of federal databases, the Cato Institute's Chris Edwards had warned me that the federal government's vast collection of sensitive data was bound to be abused and misused. He told me the main "threat is that the vast databases held by the IRS, HHS, security agencies, etc, will be leaked on purpose, leaked because of bureaucrat sloppiness, or be hacked. The more they collect, the more that will eventually leak."

In fact, two years ago, the Associated Press reported that "a former contractor for the Internal Revenue Service who pleaded guilty to leaking tax information to news outlets about former President Donald Trump and thousands of the country's wealthiest people was sentenced to five years in prison Monday."

That leak turned out to involve "the private data of more than 400,000 taxpayers," according to the House Judiciary Committee. When he was sentenced, the guilty party, Charles E. Littlejohn, insisted he "acted out of a sincere, if misguided, belief I was serving the public interest" by exposing the tax records. But his motivation hardly matters to the affected individuals who had no choice but to give sensitive information to the federal government, only to see it badly mishandled—as Edwards predicted.

In the case of Littlejohn, data was stolen out of a smug sense of outrage over the relative burdens imposed by the tax system. In the OPM incidents, information on federal employees was pilfered by a hostile foreign government. In the other IRS breaches, it was apparently taken by criminals seeking to profit.

The Danes may have been lucky, since the people who hacked their national database insist "they had no intention of selling or leaking the data" and may have just sought a challenge. Those affected will just have to hope so.

As the compromise of Denmark's national ID system demonstrates, centralized databases are tempting targets for bad actors who see in them tempting treasure troves of information if they can only find holes in security—like ridiculous password protection. The data storage company RackTop maintains a running list of government data breaches in the U.S., updated monthly.

"Several of 2026's largest government incidents ran through systems built to share documents, according to public reporting: a Defense Manpower Data Center file-sharing system, a third-party discovery-transfer tool at the Los Angeles City Attorney's Office, and a SharePoint system connected to DHS's Homeland Security Information Network," the company notes.

---

ID Requirements Address Some Security Worries While Creating Others

In the U.S., the latest calls for identification documents involve concerns that non-citizens may be casting ballots. In the days before the midterm elections, there may well be reason to ask people to prove their bona fides before participating in the political process. But whether for voting or for any other purpose, reliance on the federal government's national ID by another name—the SAVE Act specifies "a form of identification issued consistent with the requirements of the REAL ID Act of 2005 that indicates the applicant is a citizen of the United States"—builds dependency on a hacker-bait system that should itself be recognized as a security vulnerability.

CSO's Sharma added that the national ID breach is "forcing Denmark to reconsider how CPR numbers are used for identity verification. Officials are advising organizations not to rely on a CPR number alone and to use stronger mechanisms such as MitID, two-factor authentication, or one-time codes." (MitID is a state-run digital identification system in Denmark that also has security flaws.)

Denmark's national ID is no longer considered a reliable means of proving identity. Before Americans go further down the "papers, please" road, we should consider whether it poses more risks than benefits.