COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are currently examining a security breach involving unauthorized access to personal data within the country’s Central Person Register, known as CPR. The breach compromised records related to approximately 8.8 million individuals. The accessed data included names, addresses, CPR identification numbers, and other registered details. Officials confirmed that the attackers used credentials linked to a private Danish firm authorized to access the national population database, though the company’s identity has not been disclosed.
The CPR administration detected irregular activity on the evening of Oct. 2, following a series of searches conducted throughout September. After reviewing the incident over that weekend, authorities determined the scope of the breach. The CPR database contains roughly 11 million records, covering current residents, those who have moved abroad, and deceased persons. Officials indicated that the searches were confined to information categories accessible through authorized CPR services.
The individuals responsible for the unauthorized searches have not been identified. Once suspicious activity was discovered, the CPR authority revoked the company’s access. Danish police and other agencies are now investigating how the breach happened and which records were affected. An assessment was also made of data protected under Denmark’s name and address protection scheme; authorities confirmed that names and addresses under that scheme were not part of the exposed information.
Data authority scrutinizes automated CPR inquiries
Datatilsynet, Denmark’s data protection agency, was notified of the incident on Oct. 4. The regulator reported a significant number of automated searches targeting the CPR system. These searches aimed to verify the validity of CPR numbers. Datatilsynet is now investigating how unauthorized entities gained access and what personal details were retrieved. The review also includes assessing accountability for data processing in accordance with Danish privacy regulations.
Research, Education and Digitalisation Minister Christina Egelund described the event as highly serious and briefed Denmark’s Business and Digital Affairs Committee. She has ordered a comprehensive security review of the CPR system and its access controls. The government has initiated measures to minimize the risk of similar incidents in the future. Authorities are continuing to trace the incident’s sequence and evaluate the safeguards private organizations use for authorized access to CPR data.
Public advised to be cautious about potential scams
Danish officials have urged residents to remain vigilant against fraudulent communications that might exploit the exposed personal information. They advised against sharing passwords or sensitive data if a caller already appears to know their name, address, or CPR number. The government pointed residents toward official digital security resources and Denmark’s cyber hotline. It has not been confirmed whether the accessed information has been used for criminal activities such as fraud or identity theft beyond the unauthorized searches.
Ongoing investigations are focusing on the methods used to access the records, the extent of the compromised data, and the security measures governing private use of the CPR system. The authorities have not disclosed the private company involved or the specific technique employed to misuse its authorized access. As of Oct. 7, the CPR administration, police, and regulatory bodies are conducting separate inquiries into the incident, while Denmark continues to evaluate the security protocols of its national population registry.