For some more context for non-danes:

Basically any company can access to an API that lets you look up CPR(~SSN) numbers, and a lot of companies have access.

What has most likely happened is such an integration has been abused - we do not yet know whether it's by mistake or by some malicious third party. It wouldn't surprise me in the slightest if this is just the result of someone's Claude agent telling them that they can improve lookup times if they just enumerate every CPR number and cache them, for example - but we don't know yet.