COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are currently investigating a security breach involving unauthorized access to personal information stored within the country’s Central Person Register, commonly referred to as CPR. The incident involved approximately 8.8 million individuals, with data accessed including names, addresses, CPR identification numbers, and other registered details. Officials indicated that the attackers utilized credentials associated with a private Danish company that had legitimate authorization to search the national population database. The company’s name has not been disclosed by authorities.
The CPR administration detected unusual activity on the evening of Oct. 2, following a series of searches conducted throughout September. Over the subsequent weekend, officials analyzed the activity to determine the extent of the access. The CPR database contains roughly 11 million records, encompassing current residents, people who have moved abroad, and those who are deceased. Authorities confirmed that the searches only involved information accessible through authorized CPR services and remained within permitted categories.
No individuals have been identified as responsible for the unauthorized searches. Once suspicious activity was identified, the CPR administration revoked the company’s access. Danish law enforcement and other agencies are now investigating how the breach occurred and which records were accessed. They also reviewed whether any protected names or addresses under Denmark’s name and address protection scheme were compromised, finding that such protected information was not part of the exposed data.
Data authority investigates automated searches within the CPR system
Datatilsynet, Denmark’s data protection authority, received notification of the incident on Oct. 4. The agency stated that a very large volume of automated searches had taken place against the CPR database. According to the notification, these searches aimed to verify valid CPR numbers. Datatilsynet is now examining how unauthorized parties gained access and what personal data was retrieved. Its investigation also includes assessing responsibility for handling the affected data under Danish data protection laws.
Research, Education and Digitalisation Minister Christina Egelund described the incident as profoundly serious and briefed Denmark’s parliament’s Business and Digital Affairs Committee. She mandated a comprehensive security review of the CPR system and its access controls. The government has initiated measures to minimize the risk of future incidents. Meanwhile, authorities are continuing to trace the sequence of events and review the security protocols used by private organizations with authorized access to CPR data.
Public advised to be cautious of potential fraud schemes
Danish authorities have called on residents to remain vigilant against fraudulent communications, including calls, emails, and messages that might contain exposed personal information. Officials warned citizens not to share passwords or confidential details, especially if a caller already knows their name, address, or CPR number. The government has directed the public to official digital security resources and Denmark’s cyber hotline. Authorities have not confirmed that the accessed information has been used for fraud, identity theft, or other criminal acts beyond the unauthorized searches.
Investigations into the breach continue, focusing on the method of access, the records affected, and the security measures governing private use of the CPR system. Authorities have not publicly disclosed the identity of the company involved or the specific means by which its authorized access was misused. The names of those responsible for the searches have also not been revealed. As of Oct. 7, the CPR administration, police, and regulators were conducting separate reviews of the incident, while Denmark was assessing the security of its national population register.