Denmark has confirmed a major security incident involving its Central Person Register (CPR), with unauthorized parties gaining access to names, addresses and CPR numbers associated with about 8.8 million registered people. The figure includes living people, people who have moved abroad and deceased individuals; Denmark’s authorities say the investigation is still in its early stages.
The breach did not involve an attacker simply breaking into the CPR database itself, according to the government’s initial account. Instead, unauthorized parties appear to have abused the legitimate access granted to a Danish private company to make searches in the CPR system. Authorities detected unusual activity in September and were alerted to the incident on the evening of October 2, 2026.
What happened in the Danish CPR breach?
Denmark’s Central Person Register, or CPR, is the country’s core population database. It contains identifying information about people registered in Denmark and also retains records concerning people who have died or moved abroad.
According to the Danish Ministry of Research, Education and Digitalisation, CPR administrators detected irregular behaviour in the system during September. Over the weekend of October 3–4, authorities established that unauthorized parties had obtained access to personal information relating to approximately 8.8 million registered people.
The Danish Data Protection Agency, Datatilsynet, said on October 5 that it had received a formal notification from the CPR register. Its initial description says a very large number of automated searches were made against the CPR system with the apparent purpose of identifying valid CPR numbers. The agency stressed that the case is still under investigation and that it cannot yet assess the precise circumstances or responsibility.
That distinction is important. Authorities have not said that an unknown attacker obtained unrestricted access to every database field in CPR. The current evidence instead points to misuse of a legitimate company’s permitted access to the system.
Who is affected?
The headline figure is approximately 8.8 million registered people, but that does not mean 8.8 million current Danish residents have necessarily had all of their personal information exposed.
The CPR system contains records beyond the population currently living in Denmark. The government says it currently holds information on roughly 11 million registered people, including people living in Denmark, people who have emigrated and deceased individuals.
The affected population therefore includes multiple categories:
| Category | What authorities currently say |
|---|---|
| Current and former residents | Names, addresses and CPR numbers were accessed for part of the population |
| People who moved abroad | Their records can remain in CPR and are included in the affected population |
| Deceased people | Historical CPR records are also included in the reported figure |
| People with protected names and addresses | Authorities say the unauthorized access did not include names and addresses of people registered with name-and-address protection |
| Total reported affected records | About 8.8 million registered people |
The government’s figure should therefore be understood as the number of registered people whose CPR-related information was accessed, rather than a count of 8.8 million people currently living in Denmark.
What information was exposed?
The authorities have confirmed unauthorized access to names, addresses and CPR numbers, among other information. They have not yet published a definitive inventory of every individual data field accessed or established exactly what information was extracted in every case.
A CPR number is Denmark’s personal identification number. It is widely used in dealings with public authorities, financial institutions and other organizations, which makes its exposure materially different from the disclosure of an ordinary contact detail.
The Danish government has warned that people should be particularly cautious about unsolicited telephone calls, emails and text messages—even when the person contacting them appears to know their name, address or CPR number.
That is one of the most immediate risks of this incident: credible-looking fraud. A criminal who knows accurate personal information can make a phishing message or telephone call appear far more convincing than a generic scam.
The breach also illustrates why a leaked identifier should not automatically be treated as equivalent to a leaked password. A CPR number cannot simply be changed in the same way as a password. Its principal security significance comes from the way organizations use it to identify individuals and from the additional information criminals may combine with it.
Was the entire Danish population affected?
No—not according to the information authorities have released.
The reported figure is about 8.8 million registered people, while the CPR system contains roughly 11 million registered records. More importantly, the register covers people who are not currently living in Denmark, including deceased people and those who have emigrated.
There is also a specific protection for people whose names and addresses are registered as protected. The government says the unauthorized access did not include their names and addresses.
That does not necessarily mean every other category of information associated with such people is unaffected; the investigation is still determining the precise scope. It is therefore too early to translate the 8.8 million figure into a definitive list of every person and every field exposed.
How did the attackers get access?
This is one of the most important unresolved questions.
The government’s preliminary account says unauthorized parties misused a Danish private company’s legitimate access to the CPR system. Private companies with a legitimate interest can legally obtain certain CPR information under Danish law, subject to eligibility and data-protection requirements.
Authorities have not yet publicly identified the company involved or explained exactly how its legitimate access was abused.
The distinction matters because the incident raises questions not only about the security of CPR itself but also about the controls surrounding third-party access. If a legitimate account, interface or permission was used to conduct automated searches at an abnormal scale, investigators will need to establish how those searches were possible, why they were not stopped earlier and whether additional safeguards are required.
Datatilsynet says it is examining what happened, how it could happen and who was responsible for the processing of the personal data.
Who is behind the breach?
Authorities do not yet know.
The Danish government says the police investigation is in its initial phase and that it is currently impossible to say who is behind the incident.
That means claims attributing the incident to a particular hacker group, country or criminal organization should not be treated as established facts unless investigators subsequently confirm them.
This is also why the incident should currently be described as a major unauthorized-access incident or data breach, rather than confidently labeling it a particular type of cyberattack or assigning geopolitical responsibility.
What have Danish authorities done?
The company’s access to CPR has been stopped, according to the government. CPR administrators are working with specialists and relevant authorities to reconstruct what happened and determine the full extent of the incident. The case has also been reported to Datatilsynet and referred to the police.
The minister responsible for digitalisation has ordered a broader security review of the CPR system and said additional measures have already been initiated to reduce the risk of a similar incident.
Datatilsynet is separately handling the data-protection investigation. As of October 5, it says the case has only just been received and remains under active examination.
The incident follows another significant Danish data-security event involving the Technical University of Denmark, where a separate attack on DTU’s identity and access-management system potentially affected information relating to up to 200,000 current and former users. That is a separate incident and should not be confused with the CPR breach.
For broader context on why unauthorized access to large identity datasets can become more consequential when criminals combine information across systems, see the analysis of the Berlin cyberattack and its leaked files.
What should people in Denmark do now?
The authorities are advising heightened vigilance rather than suggesting that everyone should assume their identity has already been stolen.
In particular, Denmark’s official SikkerDigital service advises people to be cautious about unexpected calls, emails and text messages, avoid clicking unexpected links, and never disclose MitID credentials, one-time codes, passwords or payment-card information in response to unsolicited contact.
People who are concerned about identity misuse can also place a credit alert in the CPR register. The warning acts as a signal to banks and businesses to pay particular attention to identity verification before providing credit, although SikkerDigital notes that checking the warning is voluntary for businesses.
A credit alert is therefore a precaution, not a guarantee that fraudulent activity cannot occur.
People should also be alert to unusually convincing scams. A criminal does not need to know a victim’s password to exploit a leaked CPR number. Knowing authentic personal details can be enough to make a fraudulent caller appear to be from a bank, government agency, employer or other trusted organization.
For readers dealing with the wider implications of compromised digital identities, Denmark’s official guidance specifically recommends a credit warning and heightened attention to targeted attacks.
What remains unknown?
Several of the most consequential details have not yet been established.
Authorities still need to determine precisely how long the unauthorized activity continued, exactly which queries were made, what information was retrieved, whether all 8.8 million records were actually extracted, how the legitimate company account or access mechanism was compromised or abused, and who was responsible.
The government itself cautions that the figures and details may be refined as investigators reconstruct the incident.
That uncertainty should shape how the breach is reported. The 8.8 million figure is serious and comes from the authorities, but it should not be inflated into a claim that every person in Denmark had every piece of personal information stolen.
The more significant question now is whether the investigation reveals a weakness in the controls governing legitimate access to Denmark’s population register. If the incident resulted from legitimate access being used at an abnormal scale rather than from a conventional database intrusion, the long-term lesson may be less about one compromised system and more about how national identity infrastructure detects and limits misuse by trusted users and connected organizations. That is the part of the investigation that could determine whether the October 2026 breach was an isolated failure or evidence of a broader security-control problem.