Denmark's Central Population Register Data Breach Affects 8.8 Million
A data breach at Denmark’s Central Population Register (CPR) has exposed the personal information of 8.8 million individuals. This group includes current residents of Denmark, deceased individuals, and citizens who have relocated abroad. The CPR serves as Denmark’s national register of residents, assigning a unique 10-digit CPR number to each person, which is utilized for various purposes including taxation, healthcare, and banking.
The CPR administration became aware of irregular activities within the system on the evening of October 2, 2026. Following this discovery, they conducted an investigation over the weekend and confirmed the unauthorized access by October 4, notifying the Danish Data Protection Agency (Datatilsynet) shortly thereafter. The Danish Ministry of Research, Education and Digitalisation publicly disclosed the incident on October 5.
Christina Egelund, the Minister of Research, Education and Digitalisation, described the breach as a serious incident and informed the Danish Parliament’s Business and Digitalisation Committee. She stated that efforts are underway to assess the full extent of the breach and to implement measures to prevent future incidents. Egelund also called for a comprehensive security review of the CPR system.
The attackers exploited a legitimate access point provided to a private Danish company, which allowed them to search the CPR system. They accessed names, addresses, and CPR numbers, but the ministry clarified that the breach did not include information from individuals who had opted for name and address protection. With approximately 11 million records in the CPR, this breach affects around 80% of the register.
Response Measures and Ongoing Investigation
In response to the breach, the company’s access has been revoked, and law enforcement is conducting an investigation alongside relevant authorities. The ministry has not disclosed any suspects, stating it is too early to determine who may be responsible for the breach.
Case Closed
The Danish Data Protection Agency has initiated its own inquiry to understand the circumstances surrounding the breach, including how it occurred and who is accountable for the mishandling of personal data. The ministry has issued warnings regarding the potential misuse of the stolen data, advising citizens to remain vigilant against fraud attempts. They recommend that individuals refrain from sharing passwords or confidential information through phone calls, emails, or similar channels, even if the requester appears to know personal details.
I urge all citizens to be alert at this time and in the coming period, and to seek information at sikkerdigital.dk, Egelund concluded.
