COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are currently investigating a security breach involving unauthorized access to personal data within the country’s Central Person Register, known as CPR. This incident impacted records associated with approximately 8.8 million individuals. The compromised information included names, addresses, CPR identification numbers, and other registered details. Officials confirmed that the attackers exploited credentials linked to a private Danish company with legitimate authorization to access the national population system. The company’s name has not been disclosed.
The CPR administration identified irregular activity on the evening of October 2, following a series of searches conducted throughout September. Over the subsequent weekend, officials analyzed the activity to determine the extent of the breach. Denmark’s CPR database contains roughly 11 million entries, encompassing current residents, those who have relocated abroad, and deceased persons. Authorities emphasized that the searches stayed within information categories accessible through authorized CPR services.
The responsible parties behind the unauthorized searches have not yet been identified. After detecting the suspicious activity, the CPR administration revoked the company’s access. Danish law enforcement and related agencies are now investigating how the breach occurred and which records were accessed. Additionally, officials reviewed data protected under Denmark’s name and address protection scheme, concluding that protected names and addresses were not part of the exposed information.
Data authority assesses automated searches on CPR system
Datatilsynet, Denmark’s authority for data protection, received notification of the incident on October 4. The regulator stated that an extremely large volume of automated searches had targeted the CPR system. According to the notification, these searches aimed to verify valid CPR numbers. Datatilsynet is now investigating how unauthorized entities gained access and what personal data was retrieved. Its review also considers responsibility for managing the affected information under Danish data protection legislation.
Research, Education and Digitalisation Minister Christina Egelund characterized the incident as highly serious and briefed parliament’s Business and Digital Affairs Committee. She has ordered a comprehensive security assessment of the CPR system and its access controls. The government has also initiated measures aimed at minimizing the risk of future breaches. Authorities are continuing to trace the sequence of events and examine the security measures employed by private organizations with approved access to CPR data.
Public advised to be vigilant against potential scams
Danish officials urged residents to remain cautious of fraudulent calls, emails, and messages that might contain exposed personal information. Citizens were warned against sharing passwords or sensitive details, especially when contacted by someone claiming to already know their name, address, or CPR number. The government recommended consulting official digital security resources and Denmark’s cyber hotline for guidance. Although authorities have not confirmed that the accessed data has been used for fraud, identity theft, or other criminal acts beyond the unauthorized searches, they continue to monitor the situation.
Investigators are still examining the method of access, the specific records affected, and the security measures regulating private use of the CPR system. The identity of the company involved or the precise means used to misuse its authorized access has not been disclosed. Furthermore, authorities have yet to publicly identify those responsible for the searches. As of October 7, the CPR administration, police, and regulators are conducting separate reviews of the incident while Denmark assesses security protocols surrounding its national population register.