Your CPR Number Has 10,000 Possible Endings, and That Was the Whole Plan
Bodil Biering
Your CPR number is your birthdate plus four digits. That’s it. That’s the whole secret part.
Four digits means 10,000 possible combinations. Not 10,000 per birthdate category — 10,000, full stop, stacked on top of a date that’s frequently already known, guessable, or sitting in some register you don’t control.
And this is the number banks and government institutions treat as if it proves who you are.
It doesn’t take a hacker to see the problem. It takes someone willing to say the obvious thing out loud: a four-digit suffix was never a strong secret, and building authentication on top of it was the actual design flaw — not whatever breach eventually exposes it.
Whether any specific institution has waved someone through on a half-remembered CPR number is beside the point, and worth saying plainly: that’s anecdotal, not something witnessed directly. The deeper issue doesn’t depend on a specific org getting caught. A number that can be guessed in 10,000 tries was never built to carry the weight of “proof of identity.” Treating a guessable number as a secret was the mistake, regardless of who has or hasn’t exploited it yet.
For most people, that’s an abstract risk. But the CPR register holds more than the number itself — previous addresses, marital status, likely family details. For someone whose address needs to stay private — a witness in a court case, for instance — “the system worked as designed” is still a bad day.
The fix isn’t a better four-digit number. It’s not using a predictable identifier as a credential in the first place.
