Denmark CPR breach exposes data of 8.8 million people

Denmark's Central Population Register has disclosed a data breach that exposed personal information of approximately 8.8 million registered individuals.

Breach involved misuse of legitimate access. Threat actors misused a private Danish company's lawful access to the registry system. They obtained names, addresses, CPR numbers, and other data through brute-forcing to enumerate valid identification numbers.

The CPR system holds records for 11 million citizens. The incident affected roughly 80 percent of those entries, including residents, people living abroad, and deceased individuals.

Incident timeline and discovery. The security incident occurred in September 2026. CPR administration became aware of the breach on October 2 and determined the full scope over the following weekend.

The private company's access has since been blocked. Police have launched an investigation that remains underway.

Official response and warnings. Minister for Research, Education and Digitalization Christina Egelund described the event as an extremely serious incident and informed Parliament’s Business and Digitalization Committee. Additional security measures have been implemented on the CPR system.

A dedicated cyber hotline has been established for affected individuals. Citizens are urged to remain alert for unsolicited communications and never disclose passwords or confidential information, even when the caller or sender appears to know personal details such as name, address, and CPR number.