Roughly 8.8 million people’s names, addresses, and CPR numbers were accessed without authorization from Denmark’s Central Person Register, in what is reportedly the largest database leak in the country’s history. Digitalization Minister Christina Egelund said “This is a deeply serious incident” and acknowledged that security arrangements surrounding the access were inadequate, according to The Copenhagen Post.
CPR numbers function as Denmark’s primary identity identifier, supporting taxation, public administration, and financial verification. Combined with names and addresses, they could give criminals a significant advantage for phishing, impersonation, and social engineering.
How It Actually Happened
Attackers exploited a legitimate access pathway rather than breaching the core database infrastructure directly.
The attackers did not necessarily penetrate Denmark’s national database directly. They abused a private company’s lawful permission to query the CPR system, according to The Copenhagen Post.
Authorities have not confirmed whether an internal account was misused, or whether another technical weakness enabled the searches, per The Copenhagen Post. The company involved has not been publicly identified. The affected company’s access to the register has since been blocked.
Timeline
Unauthorized activity went undetected for roughly 10 days before administrators identified irregular behavior on October 2, 2026.
Unauthorized activity ran through September 2026 over roughly 10 days, according to The Copenhagen Post. Administrators detected irregular activity on the evening of October 2, 2026, per Cybernews.
Over the following days, authorities established that unauthorized searches had taken place and blocked the affected company’s access. Denmark’s data-protection authority was notified, and police opened an investigation in cooperation with relevant agencies.
No attribution to a specific criminal group, state actor, or country has been made public. The investigation remains ongoing.
What’s Actually at Risk
Cybersecurity experts warned that stolen CPR data could make phishing attacks more convincing when criminals already know personal details before making contact.
CPR numbers combined with names and addresses could facilitate phishing, impersonation, and social engineering. Cybersecurity experts cautioned, per The Copenhagen Post, that scam calls and emails become more credible when the caller already references your personal details.
People whose data may be involved should treat any unsolicited contact that references personal information with heightened skepticism, regardless of how legitimate it sounds. For additional guidance on how to stay safe against opportunistic threats, reviewing basic security hygiene is worthwhile. The record count exceeds Denmark’s current population because the CPR includes historical records of people who have emigrated or died. The system holds roughly 11 million records in total, per TechCrunch.
Context and Scale
This incident is reportedly the largest data breach in Danish history, though the final assessment of its scope depends on the continuing investigation.
This breach sits alongside other large-scale compromises of national identity systems, including the 2016 Turkish citizen-data exposure and incidents involving India’s Aadhaar database, per TechCrunch. Each case raises a related concern: concentrating identity data at national scale creates serious consequences when access controls fail, even without direct infrastructure penetration.
The final assessment of this incident’s scope depends on the continuing investigation into precisely what was accessed and extracted.
The incident may prompt pressure on Denmark to narrow private-sector query permissions, implement real-time anomaly detection, and require stronger authentication for organizations with CPR access. No such decisions were identified in the sources reviewed. Until stronger controls are in place, people whose data may be involved should treat unexpected contact that references personal details as suspect by default.
