Denmark has disclosed a major security breach affecting personal information associated with approximately 8.8 million people in its Central Person Register, one of the principal databases supporting the country’s digital public administration.
The Danish Ministry of Research, Education and Digitalisation said unauthorised users obtained access to names, addresses, CPR numbers and other information available through the system. A CPR number is Denmark’s unique personal identification number.
The intrusion did not involve an attacker entering through an ordinary public account. According to the ministry, the unauthorised parties misused a private Danish company’s lawful access to search the register. The company has not been publicly identified.
The ministry said the affected figure includes people currently living in Denmark, those who have emigrated and deceased people. That explains why the 8.8 million figure exceeds Denmark’s present population. The complete CPR system contains about 11 million registered individuals.
Names and addresses belonging to people enrolled in Denmark’s name-and-address protection programme were not included in that portion of the unauthorised access, according to the official account. Authorities have not yet published a complete field-by-field inventory of every category of information accessed.
Denmark’s Data Protection Agency said the incident involved a very large number of automated searches designed to identify valid CPR numbers. It received a formal notification on October 4 and is examining how the activity was possible and which organisation bears responsibility for the processing of the affected data.
The CPR administration first detected irregular behaviour on the evening of October 2 and established over the weekend that the unauthorised activity had occurred during September. It subsequently blocked the company’s access.
The incident has been reported to Denmark’s data-protection regulator, while police and other relevant authorities have opened an investigation. Officials are still reconstructing the sequence of events, meaning both the scale and technical explanation remain subject to revision.
Research, Education and Digitalisation Minister Christina Egelund called the incident deeply serious. She informed the Danish parliament’s Business and Digitalisation Committee and ordered a comprehensive security review of the CPR system.
Authorities have also introduced unspecified safeguards intended to prevent a similar incident. The government has not publicly named a suspected perpetrator, explained how the company’s access was compromised or stated whether the data has been offered for sale or used in fraud.
The most immediate public risk is social engineering. Someone possessing a person’s name, address and CPR number could appear convincing during a fraudulent telephone call, email or text message.
The Danish government has therefore warned people not to disclose passwords or other confidential information merely because a caller or sender already knows their personal details. Its national digital-security portal is directing potentially affected people to official guidance, while the Cyberhotline has extended its operating hours.
The breach also raises broader questions about third-party access to essential government databases. Although the company reportedly had legitimate permission to search the register, the scale of the automated activity was not stopped before millions of records had been accessed.
A formal assessment will need to determine whether access limits, monitoring, rate controls, authentication protections and alerting systems operated as intended.
The investigation is continuing. Until Denmark publishes a technical report, it would be premature to attribute the incident to a particular criminal group, foreign government or company employee.
