[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f2713t9bd3yj4i":56,"i-tabler:arrow-left":123,"i-tabler:tag":125},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":72,"html":73,"metaTitle":58,"metaDescription":74,"shareImage":75,"updatedAt":61,"author":79,"related":81},"denmarks-cpr-breach-is-a-warning-about-government-data-hoarding-and-philsys-should-take-note","Denmark's CPR Breach Is a Warning About Government Data Hoarding, and PhilSys Should Take Note","Outsiders pulled names, addresses and ID numbers of about 8.8 million people from Denmark's CPR register through one small company's lookup account, caught only by an invoice. Here is why central registers worry me, and what PhilSys can learn.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fchristiansborg-copenhagen-lucassantos-unsplash.jpg","2026-10-22T16:00:00.000+08:00",[63,66,69],{"key":64,"label":65},"opinion","Opinion",{"key":67,"label":68},"security","Security",{"key":70,"label":71},"philippines","Philippines",5,"\u003Cp>Denmark is the country people point to when they want to show that digital government can work. That is exactly why its latest breach should make every government with a central identity register stop and think, including ours.\u003C\u002Fp>\u003Cp>On October 5, Denmark's digitalization ministry \u003Ca href=\"https:\u002F\u002Ffudm.dk\u002Faktuelt\u002Fpressemeddelelser\u002F2026\u002Foktober\u002Fomfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger?ref=ghost.jdneer.com\">announced\u003C\u002Fa> that outsiders had obtained the names, addresses and CPR numbers of about 8.8 million people registered in the Central Person Register (CPR). That count includes the living, the dead and people who have moved abroad. The register holds about 11 million records in total, while Denmark has roughly 6 million residents, as \u003Ca href=\"https:\u002F\u002Ftechcrunch.com\u002F2026\u002F10\u002F05\u002Fhackers-steal-8-million-citizens-records-from-danish-government-database\u002F?ref=ghost.jdneer.com\">TechCrunch\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fdenmark-cpr-breach-8-8-million-records?ref=ghost.jdneer.com\">The Next Web\u003C\u002Fa> point out. People registered with name and address protection were not exposed, according to the ministry.\u003C\u002Fp>\u003Ch2 id=\"the-register-was-not-broken-into-it-was-queried\">The register was not broken into. It was queried.\u003C\u002Fh2>\u003Cp>This is the part I want everyone to understand. Nobody cracked the CPR system itself. The ministry says the intruders abused \"a Danish company's lawful access\" to search the register, staying within the data private companies are allowed to see. \u003Ca href=\"https:\u002F\u002Fnyheder.tv2.dk\u002Fbusiness\u002F2026-10-09-her-er-den-fynske-virksomhed-cpr-laekket-gik-igennem?ref=ghost.jdneer.com\">TV 2\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fwww.dr.dk\u002Fnyheder\u002Findland\u002Fafsloering-fynsk-virksomhed-er-centrum-massivt-cpr-databrud?ref=ghost.jdneer.com\">DR\u003C\u002Fa> identified the company as Pays ApS, a small data firm in Odense, and its managing director confirmed to TV 2 that the company's lawful access had been misused. Per TV 2, the company has two employees according to the Danish business register.\u003C\u002Fp>\u003Cp>According to documents \u003Ca href=\"https:\u002F\u002Fnyheder.tv2.dk\u002Fbusiness\u002F2026-10-09-nye-detaljer-om-cpr-skandale-hacker-var-over-alle-bjerge?ref=ghost.jdneer.com\">TV 2 obtained\u003C\u002Fa> and a press briefing \u003Ca href=\"https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fdenmark-cpr-breach-8-8-million-records?ref=ghost.jdneer.com\">reported by The Next Web\u003C\u002Fa>, the access began around September 10, more than 14 million automated lookups ran until September 20, and 8.8 million of them returned a record. Nobody noticed until the evening of October 2, when a staff member at the CPR office spotted an unusually large invoice for the company. Twelve days after the lookups stopped, the bill was the alarm.\u003C\u002Fp>\u003Cp>How did they get in? The official account still says only that the company's access was misused. A person claiming to be the attacker told Politiken they logged in with the password \"123456\", and Politiken reported that at least three Pays accounts, including an administrator account, used that password, as summarized by \u003Ca href=\"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F13\u002F123456-password-linked-to-denmark-data-breach-affecting-88m-people\u002F5302726?ref=ghost.jdneer.com\">The Register\u003C\u002Fa>. \u003Ca href=\"https:\u002F\u002Fwww.dr.dk\u002Fnyheder\u002Findland\u002Fafsloering-fynsk-virksomhed-er-centrum-massivt-cpr-databrud?ref=ghost.jdneer.com\">DR\u003C\u002Fa> independently found \"123456\" among the company's passwords in an old data leak, but says it could not confirm that this was the account that was abused. The claimant also said they did not intend to sell or leak the data. None of that has been confirmed by the authorities, so treat it as the hacker's account, not an established fact.\u003C\u002Fp>\u003Cp>The national police unit for serious crime is investigating, the Danish data protection authority \u003Ca href=\"https:\u002F\u002Fwww.datatilsynet.dk\u002Fpresse-og-nyheder\u002Fnyhedsarkiv\u002F2026\u002Fokt\u002Fdatatilsynet-er-opmaerksom-paa-sag-om-opslag-i-cpr?ref=ghost.jdneer.com\">Datatilsynet\u003C\u002Fa> received the notification on October 4, and as of the latest reports no one has been charged. The ministry has ordered a full security review of the CPR and says it has put measures in place to prevent a repeat. The CPR office told Datatilsynet it has now added a fixed billing check for abnormal usage, per \u003Ca href=\"https:\u002F\u002Fwww.dr.dk\u002Fnyheder\u002Findland\u002Fafsloering-fynsk-virksomhed-er-centrum-massivt-cpr-databrud?ref=ghost.jdneer.com\">DR\u003C\u002Fa>.\u003C\u002Fp>\u003Ch2 id=\"why-i-keep-saying-governments-should-not-hoard-data\">Why I keep saying governments should not hoard data\u003C\u002Fh2>\u003Cp>A central register is a promise: give us everything once, and we will keep it safe for everyone. The problem is that the promise is only as strong as the weakest party allowed to read from it. Denmark did not lose this data through its own front door. It lost it through a two-person company with a bulk lookup account, apparently without the kind of login protection we would demand for a personal email account, and without any monitoring that could tell 14 million lookups from normal business.\u003C\u002Fp>\u003Cp>And the damage cannot be rotated away. You can change a password in a minute. You cannot change your name, your address history or, in practice, a national ID number you have carried since birth. Denmark's minister told TV 2 it was too early to say whether people would get new CPR numbers, per \u003Ca href=\"https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fdenmark-cpr-breach-8-8-million-records?ref=ghost.jdneer.com\">The Next Web\u003C\u002Fa>, and the ministry is already warning people that callers who know their name, address and CPR number are not proof of anything. The more a state collects in one place, and the more parties it lets query it, the bigger and more permanent the blast radius when one of them slips.\u003C\u002Fp>\u003Ch2 id=\"what-this-means-for-philsys\">What this means for PhilSys\u003C\u002Fh2>\u003Cp>I support a working national ID. It cuts red tape and helps people who were left out of the system get banking and services. But PhilSys is now big. The Philippine Statistics Authority (PSA) \u003Ca href=\"https:\u002F\u002Fphilsys.gov.ph\u002F90m-filipinos-successfully-registered-verified-to-the-national-id\u002F?ref=ghost.jdneer.com\">reported\u003C\u002Fa> 90,290,024 registered and verified Filipinos as of October 31, 2025, and National Statistician Claire Dennis Mapa told lawmakers in September that about 97 million are now registered, \u003Ca href=\"https:\u002F\u002Fbusinessmirror.com.ph\u002F2026\u002F09\u002F22\u002F%E2%82%B12-48-b-upgrade-of-digital-support-for-national-id-set\u002F?ref=ghost.jdneer.com\">BusinessMirror reported\u003C\u002Fa>. Under \u003Ca href=\"https:\u002F\u002Flawphil.net\u002Fstatutes\u002Frepacts\u002Fra2018\u002Fra_11055_2018.html?ref=ghost.jdneer.com\">Republic Act 11055\u003C\u002Fa>, the registry holds demographic data plus a front-facing photo, a full set of fingerprints and an iris scan. That is far more sensitive than a CPR lookup.\u003C\u002Fp>\u003Cp>PhilSys is also built to be queried. Section 12 of the law lets government agencies and private entities ask the PSA to authenticate a person, and the PSA counted \u003Ca href=\"https:\u002F\u002Fbworldonline.com\u002Fthe-nation\u002F2026\u002F03\u002F26\u002F739028\u002Fpsa-95m-used-national-id-for-authentication\u002F?ref=ghost.jdneer.com\">94.7 million authentication transactions\u003C\u002Fa> by the end of March 2026, including 17.2 million from financial accounts and 13.4 million from the private sector. The government is now preparing a ₱2.48-billion project, under a public-private partnership, to upgrade and run the system, including the integration of banks and businesses, according to \u003Ca href=\"https:\u002F\u002Fbusinessmirror.com.ph\u002F2026\u002F09\u002F22\u002F%E2%82%B12-48-b-upgrade-of-digital-support-for-national-id-set\u002F?ref=ghost.jdneer.com\">BusinessMirror\u003C\u002Fa>. Every one of those connections is a door like the one Pays had in Denmark.\u003C\u002Fp>\u003Cp>To be fair, the law already gets some important things right. Section 8 limits what may be collected, Section 17 bars disclosure without consent, and Section 12 says requesting entities must get consent and use the information only for the stated purpose. Those are good rules. Denmark shows that rules on paper are not enough when one partner's login is weak. So here is what I would like to see, constructively:\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>Answer yes or no, not with records.\u003C\u002Fstrong> Authentication should confirm that a person is who they claim to be, and return as little data as possible. A partner that only needs a match should never be able to pull an address.\u003C\u002Fli>\u003Cli>\u003Cstrong>Collect and keep less.\u003C\u002Fstrong> Every field that is not stored cannot leak. Review what each partner really needs, and expire what nobody needs anymore.\u003C\u002Fli>\u003Cli>\u003Cstrong>Don't put everything in one place.\u003C\u002Fstrong> Keep biometrics separate from demographic data and partner access, so that one compromised channel cannot reach both.\u003C\u002Fli>\u003Cli>\u003Cstrong>Mandatory strong authentication for every partner.\u003C\u002Fstrong> Phishing-resistant MFA, no shared accounts, and no way to set \"123456\" at all. The PSA should audit this before connecting a partner, not after.\u003C\u002Fli>\u003Cli>\u003Cstrong>Rate limits and real-time anomaly alerts.\u003C\u002Fstrong> A partner whose volume jumps far above its customer base should be throttled within minutes, not discovered on an invoice weeks later.\u003C\u002Fli>\u003Cli>\u003Cstrong>Independent audits, published.\u003C\u002Fstrong> Regular third-party security reviews of the PSA and its biggest connected partners, with summaries the public can read.\u003C\u002Fli>\u003Cli>\u003Cstrong>Breach transparency.\u003C\u002Fstrong> If something happens, tell people quickly and plainly, the way Denmark did within days, and tell them what to watch out for.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Denmark will recover, and its quick public disclosure deserves credit. But the lesson is not \"Danes picked a bad password.\" The lesson is that a central register is only as safe as everyone with a key to it, and that the safest data is the data a government never collects in the first place. We still have time to build PhilSys with that in mind.\u003C\u002Fp>","Outsiders pulled names, addresses and ID numbers of about 8.8 million people from Denmark's CPR register through one small company's lookup account,...",{"src":60,"height":76,"width":77,"type":78},1237,2000,"image\u002Fjpeg",{"name":80,"url":10,"owner":5},"JD Bungart",[82,94,105,114],{"slug":83,"title":84,"excerpt":85,"image":86,"publishedAt":87,"topics":88,"readMinutes":93},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[89,92],{"key":90,"label":91},"advisories","Advisories",{"key":67,"label":68},1,{"slug":95,"title":96,"excerpt":97,"image":98,"publishedAt":99,"topics":100,"readMinutes":93},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[101,104],{"key":102,"label":103},"guides","Guides",{"key":67,"label":68},{"slug":106,"title":107,"excerpt":108,"image":109,"publishedAt":110,"topics":111,"readMinutes":93},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[112,113],{"key":64,"label":65},{"key":67,"label":68},{"slug":115,"title":116,"excerpt":117,"image":118,"publishedAt":119,"topics":120,"readMinutes":93},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[121,122],{"key":64,"label":65},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":124},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":126},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]