COPENHAGEN, DENMARK / RankWire.AI / – A significant security breach involving Denmark’s Central Person Register has resulted in an ongoing investigation by Danish authorities. Unauthorized access led to the exposure of personal data for approximately 8.8 million individuals. The compromised information included names, addresses, CPR numbers, and related records. Officials stated that the attackers exploited lawful access granted to a private Danish company to conduct searches within the CPR system. The CPR administration has halted this company’s access as authorities analyze the circumstances surrounding the breach.
The CPR administration identified suspicious activity on the evening of Oct. 2, following unusual search patterns recorded during September. Over the weekend, authorities reviewed the incident and confirmed the extent of unauthorized access. Denmark’s Central Person Register holds around 11 million records, encompassing current residents, those who have moved abroad, and deceased individuals. Officials emphasized that the searches remained within the scope of information that private companies are permitted to access via authorized CPR services.
The identity of those responsible for the activity has not been determined. Danish authorities have not disclosed the private company whose legal access was exploited by the attackers. The CPR administration reported the incident to Datatilsynet, Denmark’s data protection agency, and police are now investigating alongside other relevant authorities. The government stated that its review found no exposure of names and addresses protected under Denmark’s name and address protection scheme.
Regulator investigates automated searches within CPR system
Datatilsynet reported receiving the incident notice from the CPR register on Oct. 4. The agency highlighted that the case involved a very large volume of automated searches aimed at verifying valid CPR numbers, according to their notification. They are now examining what transpired, how the unauthorized access was possible, and who may be responsible for processing the personal data involved. The regulator pledged to provide additional details once sufficient information is available.
Research, Education and Digitalisation Minister Christina Egelund described the incident as extremely serious and informed Denmark’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has begun implementing measures to prevent similar incidents, while the CPR administration continues to piece together the sequence of events. Authorities noted that the investigation is still in its early stages, and further technical analysis may refine initial findings.
Public advised to remain vigilant against fraud
Danish officials urged residents to stay alert for scams involving fraudulent calls, emails, and messages that could leverage exposed personal details. Authorities emphasized that individuals should never disclose passwords or other sensitive information solely because someone knows their name, address, or CPR number. The government directed residents to consult official digital security guidance and Denmark’s cyber hotline. This warning followed confirmation that the breach involved data belonging to millions registered in the national population system.
Authorities are still evaluating how the unauthorized access occurred, which records were affected, and the safeguards around private-company use of the CPR system. Datatilsynet is independently reviewing the data protection issues raised by the incident. The CPR administration has suspended the company’s access and initiated security protocols, while officials conduct a broader review of the registry. As of Oct. 7, authorities had not publicly identified the attackers, disclosed the company’s name, or confirmed the specific method used to misuse the authorized access.