Denmark's Data Breach Exposes Personal Information of 8.8 Million
Denmark's Central Population Register (CPR) has issued a warning regarding a significant data breach that has exposed the personal information of around 8.8 million registered individuals. This breach affects not only current residents but also individuals who have moved abroad and even deceased persons.
The CPR serves as the national civil registry, containing critical personal details such as names, addresses, dates of birth, marital status, and unique CPR identification numbers. According to an announcement from the CPR, the breach occurred when threat actors exploited a private Danish company's legitimate access to the registry system, allowing them to obtain sensitive information including names, addresses, and CPR numbers.
A separate statement from the Danish Data Protection Agency revealed that the attackers employed a brute-force method to enumerate valid CPR numbers, subsequently extracting data linked to each entry. The CPR system currently holds data for approximately 11 million registered citizens, meaning that this incident impacted a significant portion of the population, approximately 80%.
The breach was detected in early October 2026, with the CPR administration becoming aware of the incident on October 2. Following the discovery, the extent of the breach was assessed over the weekend. In response, the private company's access to the registry has been revoked, and a police investigation is currently underway.
Government's Response to the Breach
Minister for Research, Education and Digitalization Christina Egelund characterized the incident as extremely serious, stating that she has informed Parliament’s Business and Digitalization Committee. Egelund emphasized that all relevant authorities are collaborating to determine the full scope of the breach.
Case Closed
In light of the incident, additional security measures have been implemented to safeguard the CPR system. Citizens are being urged to remain vigilant against unsolicited communications. A dedicated cyber hotline has been established for those potentially affected, and guidance is available online at sikkerdigital.dk.
The announcement also included a reminder for individuals to avoid disclosing passwords or confidential information in response to phone calls, emails, or similar communications, even if the sender appears to know personal details such as names, addresses, and CPR numbers. BleepingComputer has reached out to the agency for further details regarding how the private company was compromised but has not received a response as of this publication.
