COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are conducting an investigation into a significant breach involving the country’s Central Person Register. Personal information of approximately 8.8 million individuals was accessed without authorization. The compromised data included names, addresses, CPR numbers, and related records. Officials explained that the attackers exploited a private Danish company’s lawful access to search the CPR database. The CPR agency has temporarily revoked the company’s access as officials analyze how the breach happened.
The CPR agency noticed unusual activity on the evening of Oct. 2, following irregular searches in September. Over the weekend, authorities reviewed the incident and confirmed the extent of unauthorized access. The Central Person Register holds roughly 11 million records, covering current residents, those who have moved abroad, and deceased persons. Officials emphasized that the searches only involved data that private companies are permitted to access through authorized CPR services.
No suspects have yet been identified. Danish officials have also not named the private company whose legal access was exploited by the attackers. The CPR agency reported the incident to Datatilsynet, Denmark’s data protection authority, while police and other relevant authorities are investigating. The government stated that its review found no exposure of names and addresses protected under Denmark’s scheme for confidential registration.
Regulator looks into automated searches within CPR system
Datatilsynet confirmed it received the incident report from the CPR register on Oct. 4. The agency explained that the case involved numerous automated searches aimed at validating CPR numbers. The notification states that these searches were part of a broader effort to identify legitimate CPR data. Datatilsynet is currently investigating the nature of the breach, how access was gained, and who is responsible for handling the personal data. The regulator promised to share more details once sufficient information is available.
Research, Education and Digitalisation Minister Christina Egelund described the incident as very serious. She briefed Denmark’s Business and Digital Affairs Committee and ordered a comprehensive security review of the CPR system. The government is implementing measures to prevent future breaches. Meanwhile, the CPR agency continues to map out the sequence of events. Officials said that the investigation is still in its early stages and that the technical review may clarify some details.
Authorities advise public to stay vigilant against fraud
Danish officials urged residents to be cautious of scam calls, emails, and messages that could use the leaked personal data. They warned people not to share passwords or sensitive information just because a caller or sender appears to know their name, address, or CPR number. The government recommended consulting official digital security resources and Denmark’s cyber hotline. The warning came after confirmation that the breach involved data belonging to millions registered in the national population database.
Authorities are still investigating how access was gained, which records were affected, and the protections around private-company use of the CPR system. Separately, Datatilsynet is reviewing data protection issues linked to the incident. The CPR agency has cut off the company’s access and implemented security measures. Officials are also conducting a broader review of the registry. As of Oct. 7, authorities had not publicly identified the perpetrators, named the company involved, or revealed the exact method used to misuse authorized access.