data theft

Data theft denotes the unauthorised copying, extraction or transfer of data from an IT system to which the perpetrator has no lawful access. The term is not a precise legal term, but a widespread shorthand in crime reporting and media language for the kind of digital attacks known from cases such as the mass hack of Equifax and the Sony hack, where large volumes of data were pulled out of other parties' systems without permission. Unlike traditional theft, data theft does not involve the removal of a physical object — instead, data is copied or exfiltrated while the original typically remains in place. This makes the concept legally complex, since the classic theft provisions presuppose a physical dispossession.

In Danish criminal law, the central provision is the Danish Penal Code (straffeloven) § 263(1), which criminalises unauthorised access to another person's data systems or data. This is the provision that typically applies when someone breaks into an IT system and accesses or extracts information they have no right to. In more serious cases — including attacks of a particularly systematic or organised nature — § 263(3) on aggravating circumstances may come into play. This part of the provision is particularly relevant in cases concerning state cyber espionage or coordinated hacking campaigns, such as those attributed to China's military or North Korea in the cases mentioned.

Large-scale data theft typically entails not only the loss of confidential information, but can have far-reaching consequences for individuals, companies and state security alike — including the exposure of personal data, trade secrets and classified information.