Danish CPR Register Faced Unauthorized Access to 8.8 Million Records
Danish authorities are investigating unauthorized access to the names, addresses and CPR numbers of approximately 8.8 million records. The access was allegedly obtained by abusing a private company’s authorization.
The CPR register incident in Denmark affected approximately 8.8 million records. The Danish Central Person Register (CPR) administration announced that the unauthorized access involved names, addresses and CPR numbers. The company’s access has been terminated, the case was reported to the supervisory authority Datatilsynet, and police are investigating it.
According to the Danish ministry, the access was obtained by abusing the legitimate authorization of an unnamed private company that could conduct searches in the CPR system. Authorities have not yet disclosed the company’s name or the exact way its authorization was abused.
The CPR register incident involved automated queries
Datatilsynet said the report it received describes a large number of automated queries to the CPR system. Their purpose was to identify valid CPR numbers, the personal identification numbers used in Denmark.
It has not been confirmed who was behind the unauthorized access, whether the data were copied or further distributed, or what the motive was. The notice also does not confirm misuse of the data obtained and does not mention the disclosure of additional data categories beyond names, addresses and CPR numbers.
What the reported scope represents
The CPR register contains approximately 11 million records. This does not include only current residents of Denmark: the database also includes deceased people and individuals who have moved out of the country. The figure of 8.8 million therefore refers to the number of records in the register, not the number of current residents of the country.
The ministry also said that the names and addresses of people who had activated name and address protection were not affected.
Risk from combining identification data
The combination of a name, address and CPR number can increase the risk of targeted social engineering and fraud. However, this does not confirm misuse of the data or a confirmed leak of additional data categories.
The case also draws attention to private entities’ access to state identification data. According to the available information, it involved the abuse of the company’s existing authorization to search the register.
What authorities will investigate
The police investigation and Datatilsynet’s review are intended to clarify the circumstances of the access. Key questions will include confirming the exact scope of the affected data, determining whether they were exfiltrated, and identifying the responsible individuals.
Further findings may clarify the scope of the access, any exfiltration of data, and new protective measures in the CPR system.
Sources
- Forsknings-, Uddannelses- og Digitaliseringsministeriet – Officially confirms the scope of approximately 8.8 million records, the type of data accessed, the abuse of the company’s access, the blocking of access, and the police investigation.
- Datatilsynet – Confirms receipt of the report on October 4 and the review of a large number of automated queries to the CPR system.
- The Record – Independently summarizes the government’s announcement and the context of the CPR register’s scope.
Verified and updated: 05. 10. 2026 15:26
