Denmark confirms unauthorised CPR data access affecting 8.8 million people
Danish authorities have confirmed unauthorised access to names, addresses, CPR numbers and other information associated with approximately 8.8 million registered people. The activity occurred through an unnamed private Danish company’s lawful connection to the national population register, rather than through a demonstrated penetration of the register’s core infrastructure.
The Ministry of Research, Education and Digitalisation and the CPR administration disclosed the incident on 5 October 2026. Their account establishes that personal data was accessed without authorisation, but it does not confirm that complete records for 8.8 million people were copied into an external database, retained outside CPR or distributed to others.
Irregular activity detected after September lookups
The irregular activity occurred during September. The CPR administration became aware of it on the evening of 2 October and assessed its scope over the following weekend. Denmark’s data protection regulator, Datatilsynet, received an incident notification on 4 October, before the government publicly disclosed the case the next day.
Datatilsynet said the notification described a very large number of automated CPR lookups intended to identify valid CPR numbers. Its assessment remained open at the time of the disclosure. Officials had not identified the people responsible, their motive or how they obtained control of the private company’s access.
The CPR administration blocked the company’s connection as a containment measure. Police were investigating alongside relevant authorities, while Datatilsynet continued its regulatory assessment. Minister Christina Egelund said preventative initiatives had begun and ordered a thorough security review of CPR, although the government did not publicly describe those measures.
Why the affected figure reaches 8.8 million
CPR is Denmark’s nationwide population register. It assigns personal numbers for identification and stores basic information for authorised use. The register contains about 11 million people in total, rather than only Denmark’s current living population, because it also covers people who have moved abroad and people who have died.
The affected group of approximately 8.8 million similarly includes living residents, emigrants and deceased people. The number should therefore be understood as the scope of registrations associated with the unauthorised access, not as a count of Denmark’s present residents or proof that 8.8 million complete records were exported.
Official guidance allows private entities with a legitimate interest to receive defined CPR fields for people they identify individually. Authorities said the incident remained within the categories of information that private companies may receive. The unauthorised parties misused that legitimate search capability at scale.
This distinction does not lessen the seriousness of the incident, but it matters for understanding what happened. The evidence supports describing an abused third-party access channel. It does not establish a software vulnerability, authentication bypass or direct intrusion into CPR’s central systems. Authorities have also not said whether stolen credentials, an insider, inadequate controls or another cause enabled the misuse.
Access is confirmed, bulk exfiltration is not
The Ministry said unauthorised parties obtained access to information concerning approximately 8.8 million registered people. Datatilsynet described extensive automated lookups, but the official notices did not quantify how many records were returned, retained, exported or subsequently shared.
That leaves an important gap between confirmed access and confirmed exfiltration. There is no public confirmation that an attacker assembled a complete external dataset covering the full affected population, nor that the information has been published or sold. Equally, the unresolved extraction volume does not negate the confirmed scale of the unauthorised activity.
The government’s review found that the accessed information did not include the names and addresses of people registered with name and address protection. That exception is limited to those protected fields. Officials have not clarified whether CPR numbers or other non-protected information connected to those people fell within the activity, so it is too broad to say that every protected person was wholly unaffected.
Authorities warn of convincing fraudulent contact
Danish authorities advised people to be cautious if callers, email senders or other contacts appear to know their name, address or CPR number. Familiar personal details can make an approach appear credible, but recipients should not provide passwords or other confidential information in response.
SikkerDigital advised people to take extra care with unexpected messages and links, and never to disclose MitID information, one-time codes, passwords or card details. Exposure of a CPR number does not by itself establish compromise of MitID or another account. MitID’s own security guidance states that a CPR number cannot be used as a MitID user ID, and no downstream MitID compromise or identity fraud had been publicly confirmed.
People concerned about identity misuse can voluntarily place a credit warning on their CPR record. According to Borger.dk, participating organisations then receive an alert to conduct stronger identity checks. The measure is not a complete remedy, because participation by credit providers is optional, and it can make legitimate applications for loans or credit less convenient.
The central unanswered questions concern how the private company’s access was misused, how much data was retained outside CPR and whether any subsequent misuse occurred. Authorities had not answered those questions as of 5 October, while the police investigation and Datatilsynet’s assessment remained open and the security review had been ordered.
In this CPR case, how can you distinguish a misused authorised connection from proof that a complete dataset was copied? The Hack Academy’s online cybersecurity training programme gives you a self-paced route through cybersecurity fundamentals and networking, with practical exercises alongside theory.
Photo Credit: DepositPhotos.com
