COPENHAGEN, DENMARK / RankWire.AI / – Danish authorities are examining a significant breach of the country’s Central Person Register. Unauthorized individuals gained access to personal information related to approximately 8.8 million people. The compromised data included names, addresses, CPR numbers, and associated records. Officials indicated that the attackers exploited legitimate access granted to a private Danish company to perform searches within the CPR system. The CPR administration has revoked the company’s access as authorities analyze how the breach occurred.
The CPR administration identified suspicious activity on the evening of Oct. 2, after unusual search patterns were observed during September. Over the weekend, authorities reviewed the activity and confirmed the extensive nature of the unauthorized access. The Central Person Register in Denmark holds around 11 million records, which cover current residents, individuals who have moved abroad, and deceased persons. Officials stated that the searches fell within the categories of data that private companies are permitted to access through authorized CPR services.
No suspect has been identified in connection with the activity, and Danish officials have not disclosed the private company whose lawful access was exploited. The CPR administration notified Datatilsynet, Denmark’s data protection authority, while police are investigating alongside other relevant agencies. The government reported that its review found no evidence of exposure of names and addresses linked to individuals protected under Denmark’s name and address safeguard scheme.
Regulator investigates automated CPR inquiries
Datatilsynet announced it received the incident report from the CPR register on Oct. 4. The authority explained that the case involved a very high volume of automated searches on the CPR system. According to the notification, these searches aimed to verify valid CPR numbers. The regulator is now examining what transpired, how the unauthorized access was enabled, and who might be responsible for handling the personal data. Further details will be provided once there is sufficient information to do so.
Research, Education and Digitalisation Minister Christina Egelund described the incident as deeply serious and briefed Denmark’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has initiated measures to prevent similar breaches while the CPR administration continues mapping out the sequence of events. Officials emphasized that the investigation remains in early stages and that ongoing technical assessments could clarify confirmed details.
Authorities warn citizens about potential fraud schemes
Danish officials urged residents to stay vigilant against scam attempts via phone calls, emails, or other messages that might leverage exposed personal information. They emphasized that individuals should never disclose passwords or other sensitive data just because someone on the other end of the line or in a message knows their name, address, or CPR number. The government directed citizens to official digital security guidelines and Denmark’s cyber hotline. This warning came after confirmation that the unauthorized access involved data belonging to millions of registered individuals in the national population system.
Authorities are still evaluating how the breach occurred, the records affected, and the security measures around private-sector use of the CPR system. Datatilsynet is also separately reviewing the data protection concerns raised by the incident. The CPR administration has suspended the company’s access and implemented security protocols, while officials conduct a broader review of the register. As of Oct. 7, authorities had yet to publicly identify the perpetrators, disclose the company’s name, or confirm the specific method used to exploit the authorized access.