The problem
A hacker got 8.8 million CPR numbers through the CPR login of Pays ApS, a two-person firm in Odense, using a former employee's leaked password; at least three profiles used '123456'. On 9 Oct the CPR administration sent a letter to all 1,039 firms with CPR access (banks, telcos, law firms, unions, insurers). It reminds them they must have a security officer, keep checking staff access, and review CPR transactions every month. CPR's terms also require a log of each user's start and end dates and new passwords at least every 90 days. Most small firms do this by memory or in a spreadsheet, if at all.
Why now · sources
Who it's for
Firms with CPR register access
Freemium sketch
Free: CPRWeb terms checklist and a register of up to 3 authorised users. Paid (~149 kr/month; ~499 kr/month for groups and advisers): unlimited users, 90-day password and monthly review reminders, transaction-statistics upload with spike flags, offboarding trigger when someone leaves, a signed monthly review log and audit PDF. Later: the same review for MitID Erhverv, bank and e-Boks access.
Competitors
ComplyCloud (broad Danish GDPR/ISO 27001/NIS2 platform), Vanta and Drata (international, expensive), identity tools like Entra ID or Okta. None offer a CPRWeb-specific monthly review.
Build notes
Next.js + shadcn, Neon (EU), Auth.js with MFA required. CPRWeb has no stats API, so v1 uses CSV or manual entry of monthly counts plus simple spike detection. Resend reminders via Vercel cron, hashed PDF review receipts.
Comments 0
No comments yet. Would you use this? Say what would make you pay.