Centralized data stores and nationwide identity schemes present highly attractive targets for bad actors.
Like much of the rest of the world, the United States is edging toward a society that increasingly feels like a “papers, please” regime, where proving who you are becomes a routine part of daily life. The current push for a universal ID centers on voting, with the stalled SAVE America Act aiming to supersede state procedures by requiring REAL ID–compliant documents before residents cast ballots. Whatever the stated rationale, supporters claim that identity requirements will enhance security, yet a breach of Denmark’s national ID framework shows that such a system can become tempting prey for hackers.
You are reading The Rattler from J.D. Tuccille and Reason. Get more of J.D.’s commentary on government overreach and threats to everyday liberty.
Hackers Harvest Records on Approximately 8.8 Million People
“Denmark is reevaluating security controls around its national citizen registry after unauthorized parties exploited a company’s access credentials to harvest records on roughly 8.8 million individuals over a 10-day window,” reported Shweta Sharma of CSO, a publication focused on enterprise security, earlier this month. “The breach includes residents of Denmark as well as individuals who have died or relocated abroad, while those with protected names and addresses were not affected.”
The intruder who breached Denmark’s Central Register of Persons (CPR) asserts entry came through a partner company that used “123456” as its password. Danish authorities are scrambling to rethink their security practices, assess the implications of the exposed data on what appears to be nearly the entire population, and determine whether similar weaknesses exist in other critical public IT systems.
It is tempting to marvel at the hazards of compiling a national database containing identifying information about a country’s people and then guarding it with the simplest possible password. Yet Americans are not in a position to relish Denmark’s embarrassment—though we should empathize with Danish citizens—given our own government’s comparable blunders.
The U.S. Government’s History of Data Breaches
Back in 2015, the federal Office of Personnel Management (OPM) suffered a substantial data breach driven by Chinese government hackers. The initial figure cited for the compromise of its background investigation databases was 4 million individuals. Later, after a second incident, the tally climbed to 21.5 million people whose “residency and educational history; employment history; information about immediate family and other personal and business acquaintances; health, criminal and financial history; and other details” had been disclosed to intruders.
That breach cast a long shadow. Government-provided credit monitoring and identity theft protection for those affected only began expiring earlier this year.
To be sure, when compared with the scale of the OPM data loss, the somewhat earlier incident at the Internal Revenue Service (IRS) involving the theft of Social Security numbers, birthdates, and home addresses of about 100,000 people hardly stands out by contrast.
The Inherent Vulnerability of Centralized Databases
A year before those hackers conducted one-stop data shopping through federal databases, the Cato Institute’s Chris Edwards warned me that the government’s vast stores of sensitive information are prone to misuse. He argued that the principal threat is that the extensive databases maintained by the IRS, HHS, security agencies, and others will be leaked—whether deliberately, through bureaucratic slip-ups, or via hacking. The more they accumulate, the more data will eventually escape.
In fact, two years ago, the Associated Press reported that “a former contractor for the Internal Revenue Service who pleaded guilty to leaking tax information to news outlets about former President Donald Trump and thousands of the country’s wealthiest individuals was sentenced to five years in prison Monday.”
That leak turned out to involve “the private data of more than 400,000 taxpayers,” according to the House Judiciary Committee. When he was sentenced, the guilty party, Charles E. Littlejohn, claimed he acted out of a sincere, if misguided, belief that he was serving the public interest by exposing the tax records. But his motive hardly matters to the people affected, who had to entrust sensitive information to the federal government only to see it mishandled—as Edwards had warned.
In Littlejohn’s case, data was stolen as part of a misguided backlash against the tax system. In the OPM incidents, information on federal employees was pilfered by a hostile foreign government. In the other IRS breaches, thieves apparently aimed to profit financially.
The Danes may have been fortunate in that the hackers behind their national registry claim they did not intend to sell or leak the data and were perhaps simply seeking a challenge. The harmed individuals will have to hope that is true.
As Denmark’s breach of its national ID system demonstrates, centralized databases attract bad actors who view them as treasure troves of information if they can locate any security gaps—such as outrageously weak passwords. RackTop, a data-storage company, maintains a running monthly tally of government data-breach incidents in the United States.
“Several of 2026’s largest government incidents stemmed from systems designed to share documents, including a Defense Manpower Data Center file-sharing platform, a third-party discovery-transfer tool used by the Los Angeles City Attorney’s Office, and a SharePoint setup linked to DHS’s Homeland Security Information Network,” the firm notes.
ID Requirements Address Some Security Worries While Creating Others
In the United States, the renewed push for identity documents centers on worries that non-citizens might cast ballots. With elections approaching, there is a case to consider requiring individuals to prove their credentials before taking part in the political process. Yet whether for voting or any other purpose, relying on a federal national ID, under another label—the SAVE Act calls for “a form of identification issued consistent with the requirements of the REAL ID Act of 2005 that indicates the applicant is a citizen of the United States”—creates a system that is itself vulnerable to exploitation and should be recognized as such.
CSO‘s Sharma added that the national ID breach is “forcing Denmark to reconsider how CPR numbers are used for identity verification. Officials are advising organizations not to rely on a CPR number alone and to employ stronger mechanisms such as MitID, two-factor authentication, or one-time codes.” (MitID is Denmark’s state-operated digital ID system, which also has its share of security flaws.)
Denmark’s national ID is no longer viewed as a reliable way to prove identity. Before the United States plunges further into a “papers, please” regime, we should weigh the potential risks against the purported benefits.
