Denmark has confirmed the theft of most of its national population database. The Central Person Register, known as CPR, holds names, addresses, birth dates, marital status and the CPR number every resident uses for taxes and public services. TechCrunch compared those numbers to Social Security numbers.

The attackers did not break down the front door. Officials said they misused a Danish company's lawful access to the registry. Some companies can search the CPR to check people's details. Denmark's Data Protection Agency said the attack used a kind of guessing, called brute-forcing, to find valid CPR numbers and then pull each record, according to BleepingComputer.

The theft happened in September. The CPR office found it on Oct. 2 and worked out its size over the weekend. The company's access has been blocked, and police are investigating. The government has not said who is behind it.

"This is an extremely serious incident," said Christina Egelund, Denmark's minister for research, education and digitalization. She said she had briefed a committee of parliament.

The numbers are huge for a small country. Denmark has about 6 million people, but the registry holds about 11 million records, some going back decades, TechCrunch reported. That includes people who have moved abroad and people who have died. TechCrunch said it is believed to be the biggest data breach in Danish history.

The main danger now is fraud. Officials set up a cyber hotline and posted guidance online. They warned people never to share passwords by phone or email, "even if the recipient appears to know your name, address, and CPR number."

This is not the first national ID database to leak. TechCrunch pointed to a 2016 breach that affected millions of Turkish citizens and repeated exposures from India's Aadhaar ID system.

What we know: Hackers used a company's legitimate access to copy most CPR records in September.
What we don't: Who did it, and how the company's access was abused.