COPENHAGEN, DENMARK / RankWire.AI / – A significant breach involving Denmark’s Central Person Register has prompted authorities to expand their inquiry, revealing that personal data associated with approximately 8.8 million people was compromised. The leaked information included names, addresses, CPR numbers, and related records. Officials confirmed that the attackers exploited legitimate access granted to a private Danish company to search the CPR system. In response, the CPR administration has revoked the company’s access as investigations into the incident continue.
The CPR administration identified suspicious activity on the evening of Oct. 2 after noticing unusual search patterns in September. Over the weekend, authorities examined the activity and verified the extent of the unauthorized access. The Central Person Register holds around 11 million records, encompassing current residents, individuals who have moved abroad, and deceased persons. Officials emphasized that the searches were confined to information categories that private companies are permitted to access through authorized CPR services.
To date, the identity of those responsible for the activity remains unknown. Danish officials have not disclosed the private company whose lawful access was exploited. The incident was reported to Datatilsynet, Denmark’s data protection agency, and police are investigating alongside other relevant authorities. The government stated that its review found no exposure of names and addresses protected under Denmark’s name and address protection scheme.
Regulatory body scrutinizes automated CPR inquiries
Datatilsynet announced it received a report about the incident from the CPR register on Oct. 4. The agency indicated the case involved a substantial number of automated searches targeting the CPR system, aimed at verifying valid CPR numbers, according to the notification. The regulator is currently examining the circumstances of the breach, how the unauthorized access was enabled, and who is responsible for processing the involved personal data. Further information will be provided once sufficient facts are available.
Research, Education and Digitalisation Minister Christina Egelund described the incident as highly serious and briefed parliament’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has initiated measures to prevent similar breaches, while the CPR administration continues to reconstruct the sequence of events. Authorities noted that the investigation is still in its early stages and that ongoing technical assessments may clarify confirmed details further.
Public advised to remain vigilant against fraud schemes
Danish officials urged citizens to be cautious of fraudulent calls, emails, and messages that could exploit exposed personal information. They emphasized that individuals should not disclose passwords or other confidential details simply because someone claims to know their name, address, or CPR number. The government directed residents to official digital security resources and Denmark’s cyber hotline. This advisory followed confirmation that the unauthorized activity involved data belonging to millions of registered people within the national population registry.
Authorities remain focused on investigating how access was gained, which records were affected, and what protective measures are in place around private-sector use of the CPR system. Datatilsynet is also separately reviewing the data protection implications of the breach. The CPR administration has suspended the company’s access and implemented security protocols, while officials conduct a broader review of the registry. As of Oct. 7, authorities had yet to publicly identify the perpetrators, disclose the company’s name, or confirm the specific method used to misuse the authorized access.