News Data Breaches

Denmark CPR breach: data on 8.8 million people accessed through a company's lookup rights

Unauthorised parties obtained the names, addresses and CPR numbers of about 8.8 million people from Denmark's Central Person Register, the Danish government said on 5 October 2026. They misused a private Danish company's lawful right to search the register; that access has been stopped and police are investigating.

with inforaam Published
Denmark CPR Register data breach illustration showing a compromised database, Danish flag, exposed personal data, and cyberattack imagery.

Key takeaways

  • About 8.8 million people's names, addresses and CPR numbers were accessed, including people who have died or emigrated.
  • The intruders misused a private Danish company's lawful right to search the CPR, not a flaw in the register itself.
  • The company's access has been stopped, Datatilsynet has been notified and police are investigating.
  • People with name and address protection are not included, according to the ministry.
  • No one has been named as responsible; the investigation is at an early stage.

Unauthorised parties obtained the names, addresses and CPR numbers of about 8.8 million people held in Denmark's Central Person Register (CPR), the Danish government said on 5 October 2026. They did it by misusing a private Danish company's lawful access to search the register.

What happened? #

Denmark's CPR administration became aware on the evening of Friday 2 October 2026 of irregular activity in the CPR system during September. Over the weekend it established that unauthorised individuals had obtained names, addresses, CPR numbers and other details. The ministry responsible for the CPR, Forsknings-, Uddannelses- og Digitaliseringsministeriet, announced the incident on Monday 5 October.

The access ran through a private Danish company that is legally allowed to search the CPR. The intruders stayed within the categories of information that private companies are permitted to receive.

Who is affected? #

About 8.8 million registered people, including living residents, people who have emigrated and people who have died. The CPR holds about 11 million registered people in total, while Denmark's population is roughly six million.

The ministry says the unauthorised access did not include the names and addresses of people registered with name and address protection.

What has Denmark done so far? #

  • Stopped the company's access to the CPR.
  • Reported the incident to Datatilsynet, the Danish Data Protection Agency.
  • Passed the case to the police, who are investigating with other relevant authorities.
  • Launched measures to prevent a repeat and ordered a full security review of the CPR system.

Minister Christina Egelund said she had briefed the Danish parliament's Business and Digitalisation Committee. The ministry says the investigation is at an early stage and that it is not yet possible to say who is behind the access.

How do private companies get CPR access? #

Under section 38 of the Danish CPR Act, private companies with a legitimate interest may receive CPR information about a defined group of people they have already identified one by one, for example by CPR number, date of birth and name, or by name and address. They must also be entitled to the data under the GDPR and the Danish Data Protection Act.

What should people registered in Denmark do now? #

The Danish authorities warn that the personal details can be misused for fraud. Never give out passwords or other confidential information in phone calls or emails, even when the person contacting you appears to know your name, address and CPR number. Guidance is available at sikkerdigital.dk, and the Cyberhotline for digital security (+45 33 37 00 37) announced extended opening hours of 08:00 to 24:00 for the days after the announcement.

Sources

  1. Forsknings-, Uddannelses- og Digitaliseringsministeriet press release, 5 Oct 2026 (Danish), Forsknings-, Uddannelses- og Digitaliseringsministeriet (Danish Ministry of Research, Education and Digitalisation)
  2. CPR notice, 5 Oct 2026 (Danish), CPR, Det Centrale Personregister
  3. The Record: population context, roughly six million, The Record by Recorded Future News

Questions this raises

Was my CPR number exposed?
The ministry says about 8.8 million of the roughly 11 million people registered in the CPR are affected. It has not published a way to check individual records.
Who did it?
The ministry says it is not yet possible to say who is behind it.
What should I watch for?
Calls or emails that use your name, address or CPR number to ask for passwords or codes. The authorities say never share them.

DenmarkCPRData Breachgovernmentthird-party accessidentity fraudGDPR