Denmark is investigating a major data breach at its Central Population Register (CPR) that exposed the personal information of approximately 8.8 million people, including current residents, citizens living abroad, and deceased individuals. The register contains around 11 million records, meaning roughly 80% of its data was affected. The compromised information includes names, addresses, and 10-digit CPR identification numbers, which are essential for accessing healthcare, banking, taxation, and government services. Attackers reportedly exploited a private Danish company’s legitimate access to the system and used automated searches to identify valid CPR numbers and extract associated information. The CPR administration discovered irregular activity on October 2, 2026, and notified the Danish Data Protection Agency on October 4, while the government publicly disclosed the breach on October 5.
Denmark’s authorities have blocked the company’s access, launched a police investigation, and begun examining how the breach occurred and who was responsible. Officials confirmed that people with protected names and addresses were not affected by the unauthorized access identified so far. Research, Education and Digitalisation Minister Christina Egelund called the incident “a deeply serious incident” and ordered a comprehensive security review alongside measures to prevent similar attacks. Authorities have also warned citizens about potential fraud and phishing attempts, urging them never to disclose passwords or confidential information, even if a caller or email sender knows their personal details. A dedicated cyber-security hotline and the website sikkerdigital.dk are available to provide guidance to potentially affected individuals.
The breach is the most significant incident involving Denmark’s CPR system since 2015, when two unencrypted CDs containing information on more than five million people were mistakenly delivered to the Chinese Visa Application Centre in Copenhagen. At the time, authorities reported no evidence that the data had been copied or leaked. The latest incident highlights the risks of granting private companies access to centralized databases containing sensitive personal information and raises concerns about the long-term consequences of exposing identification numbers that remain valid throughout a person’s lifetime.
Read more about it here.