Misused company access reached 8.8 million Danish register records

• Denmark’s CPR Administration says unauthorised users accessed records associated with about 8.8 million people.
• The access used a private Danish company’s legitimate permission to search the register; the company’s access has since been stopped.
• The records included names, addresses and CPR numbers, Denmark’s personal identification numbers.
• The regulator says the incident involved numerous automated searches. Investigators have not publicly established whether records were copied or retained.

Denmark’s Central Person Register, known as CPR, holds records for about 11 million people. The 8.8 million figure includes people who have died or moved abroad; it is not the number of people currently living in Denmark. The Ministry of Research, Education and Digitalization said the unauthorised access involved names, addresses and CPR numbers, among other information, but did not itemise any additional fields. ¹

The route into the system was not described as a break-in to the register itself. Authorities say unauthorised people misused a Danish company’s lawful access to search CPR. The ministry has not named the company or explained how the misuse happened. ¹

The CPR Administration noticed irregular activity on the evening of Friday, 2 October. The ministry said the activity had occurred during September and that officials identified the unauthorised access over the weekend, then stopped the company’s access. Digitalisation Minister Christina Egelund told news agency Ritzau that the access lasted about ten days and that security around the company’s access had not been good enough. ^{1 2}

The Danish Data Protection Agency said it received the CPR Administration’s incident report on Sunday, 4 October. The report described a very large number of automated searches intended to identify valid CPR numbers. The agency said it was beginning to examine what happened, how it happened and who was responsible. ³

Those search details do not establish whether records were downloaded in bulk, kept or passed on. The ministry’s public account confirms unauthorised access to information associated with the 8.8 million registered people, but does not settle what happened to the information afterwards. Nor does it specify whether CPR numbers belonging to people with name-and-address protection were accessed: the ministry says their names and addresses were not included. ^{1 3}

CPR numbers are used in Danish healthcare, banking and government services and are intended to last a lifetime, according to The Record. That makes the incident consequential even before investigators determine whether the information was copied or used. The ministry advised people not to share passwords or other confidential details in response to calls or emails, even if the sender appears to know their name, address or CPR number. ^{4 1}

Police are investigating with relevant authorities. Egelund has also ordered a security review of the CPR system. ¹

Footnotes

1. Denmark’s Ministry of Research, Education and Digitalization, “Omfattende uautoriseret adgang til borgeres CPR-oplysninger” (5 October 2026) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

2. The Copenhagen Post, carrying Ritzau reporting, “Danish minister says security was inadequate after access to 8.8 million personal records” (5 October 2026) ↩

3. Danish Data Protection Agency, “Datatilsynet er opmærksom på sag om opslag i CPR” (5 October 2026) ↩ ↩²

4. The Record, “Data breach at Denmark’s national population register exposes 8.8 million people” (5 October 2026) ↩