Denmark CPR Breach Exposes Identity Data of 8.8 Million People

Attackers used a Danish private partner's legitimate access to query the Central Person Register and obtained names, addresses, and CPR numbers for about 8.8 million people. Officials found anomalous activity on 2 October 2026 and determined the incident occurred in September.

Incident

Danish authorities are investigating a breach in which unauthorized users obtained data from the national population register. About 8.8 million people are affected.

Attackers used the legitimate access of an unnamed Danish private company to the Central Person Register (CPR) and obtained names, addresses, and CPR numbers. A CPR number is comparable to a U.S. Social Security number or a Chinese national ID number.

CPR holds records on about 11 million people, including current residents, people who have moved abroad, and deceased persons. Denmark's population is slightly above 6 million.

Christina Egelund, Minister for Higher Education and Science, described the incident as extremely serious. She ordered a full security review of the system. Denmark's digital security hotline will extend hours in the coming days, operating from 08:00 to midnight.

Officials said they first observed anomalous activity affecting CPR on Friday, 2 October 2026. After a weekend investigation, agencies determined the breach occurred in September. They have not identified the attacker or a responsible organization.

Long-lived identity risk

The Danish Data Protection Agency said it received the breach notification on Sunday. It said someone issued large volumes of automated queries in an attempt to find valid CPR numbers.

A CPR number is 10 digits and begins with the person's date of birth. It is widely used in healthcare, banking, and government services. Because CPR numbers typically do not change for life, affected people may face lasting risk.

Egelund said the government has added further security measures in CPR to prevent a repeat, and asked the public to treat unsolicited contact with caution.

Denmark opened a dedicated cybersecurity hotline for people who may be affected. Guidance is also available at sikkerdigital.dk.

The government reminder states that no one should disclose passwords or other secrets in response to phone calls, email, or similar messages. The notice stresses that passwords and other secrets still must not be provided even if the other party already appears to know the recipient's name, address, and CPR number.

Other national register incidents

Large leaks involving national population registers have also been reported in Argentina (2021), Turkey (2016), India (2018), and Israel (2006).

Dray Agha, senior manager of security operations at Huntress, said the incident shows the inherent risk of highly centralized national databases, especially when private firms have direct access to sensitive data. He said compromise of a single vendor account can bypass core agency controls and turn a legitimate data connection into a channel for mass exposure.

Nathan Davies-Webb, principal consultant at Acumen Cyber, said centralized systems of this kind should receive the highest attention. He said the transparent handling, including extended digital security hotline hours, suggests agencies may already have an incident response plan and are following it.

Reporting on this incident draws on The Record: https://therecord.media/denmark-breach-register-cyberattack