Unauthorized parties accessed and exfiltrated personal data from approximately 8.8 million records in Denmark’s Central Person Register (CPR), including names, addresses and national identification numbers. The affected records cover living people, people who have moved abroad and deceased people, while authorities investigate how attackers misused a private company’s legitimate access to the registry.
Key Points
- Approximately 8.8 million CPR records, or about 80% of the registry, were affected.
- The exposed information includes names, addresses and CPR numbers, creating risks of fraud and targeted social engineering.
- Attackers reportedly used a private company’s permitted access to search for valid CPR numbers and retrieve associated data.
- The company’s access has been blocked, while Danish police and the Data Protection Agency investigate.
Established in 1968, the CPR is Denmark’s national civil and population registry. It holds roughly 11 million records, and the Danish Ministry of Research, Education and Digitalisation administers the system.
The compromised information includes names, addresses and CPR numbers. The ministry said the unauthorized access did not include the names and addresses of people who had registered for name and address protection.
Irregular system behavior occurred during September 2026. CPR administrators became aware of the incident on the evening of Friday, 2 October, determined the extent of the unauthorized access over the weekend, notified the Danish Data Protection Agency on Sunday, 4 October, and disclosed the breach on 5 October.
Christina Egelund, Denmark’s minister of research, education and digitalisation, said:
“This is a deeply serious incident, which I have therefore also informed the Danish Parliament’s Business and Digitalisation Committee about. Together with all relevant authorities, we are in the process of mapping the entire extent of the incident.”
Christina Egelund, Minister of Research, Education and Digitalisation
How the breach happened
The attackers did not reportedly break into the CPR through an identified software vulnerability. Instead, they misused a private Danish company’s lawful access to search the registry and extracted data through that access. Authorities have not publicly named the company.
The Danish Data Protection Agency, also known as Datatilsynet, said the activity involved a form of brute-forcing to identify valid CPR numbers and then retrieve the associated records. The attackers reportedly stayed within the types of information that private companies are permitted to request, but used the allowed query process at scale to extract data.
The scope covers approximately 8.8 million records, representing about 80% of the roughly 11 million records held in the CPR. The affected population includes current residents, emigrants and deceased people.
Investigation and public guidance
The private company’s access to the CPR was blocked after the activity was identified. Danish police and relevant authorities opened an investigation, while the Data Protection Agency opened a separate case. Authorities have not publicly identified a suspect, linked the incident to a specific threat actor or disclosed a specific vulnerability, and the investigation remains at an early stage.
The Ministry of Research, Education and Digitalisation requested a thorough security review of the CPR system and said preventive measures had been launched. Officials warned that names, addresses and national identification numbers can support convincing fraud, phishing and social-engineering attempts.
Authorities advised residents not to provide passwords or other confidential information in response to unsolicited calls or emails, even when the caller knows their name, address or CPR number. Citizens can find information at sikkerdigital.dk and contact the Cyberhotline for Digital Security at +45 33 37 00 37. The hotline’s hours were extended to run from 8:00 to 00:00 after the breach.
About the Author
