Denmark CPR Breach Exposes 8.8 Million People
Denmark's Central Person Register (CPR) has confirmed a serious security incident in which unauthorized parties accessed names, addresses, and CPR numbers for approximately 8.8 million registered individuals. The attack did not exploit a software vulnerability. It abused a private Danish company's legitimate access to the CPR database, extracting records within the scope of what private businesses are normally allowed to request [1][2].
The CPR system holds roughly 11 million records, covering living residents, emigrants, and the deceased. The 8.8 million figure covers everyone whose data was accessible through the compromised company's credentials. People registered with name and address protection were not affected [1].
The breach was discovered on the evening of Friday, October 2, 2026, after irregular behavior was detected in the CPR system during September. Over the weekend, CPR administration determined the full scope: someone had been using a private company's legal access to query the database and pull personal data on a massive scale [2].
Minister of Research, Education and Digitalisation Christina Egelund called it "a deeply serious incident" and has informed the Danish Parliament's Business and Digitalisation Committee. CPR administration has reported the breach to the Danish Data Protection Authority (Datatilsynet), and police are investigating. The company's access has been revoked [2].
The ministry has launched a comprehensive security review of the CPR system and implemented immediate measures to prevent similar incidents. A Cyberhotline has extended its hours (8:00 to 24:00) for citizens concerned about digital security. Officials warn that even though the attacker knows your name, address, and CPR number, you should never share passwords or other confidential information in response to phone calls or emails, even if the caller seems to know your details [2].
This is not a hack in the conventional sense. No firewall was breached, no zero-day was exploited. A private company with a legitimate right to query CPR was compromised, and whoever gained access to that company's credentials treated the entire database as their own lookup tool. The vulnerability was not in the code. It was in the trust model: a private entity with broad query access and apparently insufficient controls on how that access was used [1][2].
Sources:
[1] CPR Administration - Official announcement (Danish)
[2] Ministry of Research, Education and Digitalisation - Press release (Danish)
[3] Hacker News discussion (76 points, 35 comments)