Denmark CPR Data Breach Exposes 8.8 Million Records via Company Account Access

Denmark's digitalization ministry announced on October 5, 2026, that unauthorized parties gained access to the Central Person Register (CPR), the country's national population database. The breach exposed names, personal addresses, and CPR (Central Person Register) numbers for approximately 8.8 million people, including both living and deceased individuals.

According to reports, the attackers exploited a private Danish company's lawful right to look up records in the CPR register. The ministry has advised affected individuals to remain vigilant, though the specific advisory guidance was truncated in initial reports. The CPR register contains core personal data for the Danish population and is used extensively by government and private sector entities for identity verification and service delivery.

The disclosure highlights growing concerns around the security of centralized population registries and the potential for abuse when lawful access mechanisms are exploited. Danish authorities have not detailed the technical method used in the exploitation, noting only that it involved leveraging authorized access pathways. No specific software patch applies to this incident, as the issue pertains to registry access controls and oversight rather than a software vulnerability.