Denmark's massive data leak was caught by a billing check, not an alarm. Officials said Tuesday that the theft of personal data on 8.8 million people came to light because a small company sent in an unusually large invoice.

Each search of the national registry, called the CPR, carries a small fee. A routine billing check flagged the size of the company's bill for September. "There is a very large amount that was invoiced, which makes you aware that there has been a lot of activity," Mikkel Leihardt of the digital affairs ministry told reporters, The Local reported.

The company, which has not been named, had legal access to the registry. Someone abused that access. The registry had no automatic alarm for the type of lookup used, and the leak could have gone unnoticed for at least another 30 days, The Local reported.

The CPR number is a 10-digit ID Danes use for taxes, health care and banking, Help Net Security noted. The stolen data includes names, addresses and CPR numbers for living people, the dead and citizens who moved abroad. That is about 80% of the registry's roughly 11 million records. People with protected addresses were not included.

The timeline is short. Officials learned of odd activity on the evening of Friday, Oct. 2, notified the country's data protection agency on Sunday and went public Monday.

No suspect has been named. "In these type of cases, it is often cross-border crime," said Henriette Erbs of the National Unit for Serious Crime. Laila Reenberg of the Danish Agency for Social Security said digital fraud is the obvious worry.

Minister Christina Egelund called it "a deeply serious incident" and ordered a full security review. Officials urge Danes never to share passwords by phone or email, "even if the recipient apparently knows your name, address and CPR number." Advice is posted at sikkerdigital.dk.

What we know: A routine invoice check exposed the abuse of one firm's legal access.
What we don't: Who did it and what they plan to do with the data.