COPENHAGEN, DENMARK / RankWire.AI / – Danish authorities are actively probing a significant breach of the country’s Central Person Register. Unauthorized individuals gained access to personal information of approximately 8.8 million people. The compromised data included names, addresses, CPR numbers, and related records. Officials stated that the perpetrators exploited a legitimate access point provided to a private Danish company to search the CPR system. The CPR administration has suspended the company’s access as investigations into the incident continue.
The CPR administration identified suspicious activity on the evening of Oct. 2 following unusual search patterns observed throughout September. Over the weekend, authorities reviewed the activity and confirmed the extent of the unauthorized access. The Central Person Register holds around 11 million records, covering current residents, individuals who have moved abroad, and deceased persons. Officials emphasized that the searches remained within the scope of information that private companies can legally access via authorized CPR services.
To date, the investigation has not determined who conducted the activity. Danish officials have not disclosed the identity of the private company whose lawful access was exploited. The CPR administration reported the breach to Datatilsynet, Denmark’s data protection authority, and police are collaborating with other relevant agencies. The government indicated that its review found no exposure of names and addresses protected under Denmark’s name and address protection scheme.
Regulator reviews automated searches within CPR system
Datatilsynet announced it received the incident report from the CPR register on Oct. 4. The regulator highlighted that the case involved a vast number of automated queries aimed at verifying valid CPR numbers. The notification specifies that these searches sought to identify legitimate CPR identifiers. Datatilsynet is investigating the circumstances of the breach, how access was gained, and who is responsible for processing the personal data involved. The agency stated it will release additional details once sufficient evidence is available.
Research, Education and Digitalisation Minister Christina Egelund characterized the incident as highly serious and briefed parliament’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has implemented measures to prevent future breaches, while the CPR administration continues to piece together the sequence of events. Authorities noted that the investigation remains in its early stages and that ongoing technical assessments may clarify certain details.
Officials caution the public against fraud attempts
Danish authorities have urged residents to stay vigilant against scams involving fraudulent calls, emails, and messages that may exploit exposed personal data. Officials emphasized that individuals should never share passwords or other confidential information simply because someone on the phone or in an email claims to know their name, address, or CPR number. The government directed residents to consult official digital security resources and Denmark’s cyber hotline. This warning came after confirmation that the unauthorized activity involved data belonging to millions of registered individuals within the national population registry.
Authorities continue to analyze the breach pathway, the affected records, and safeguards related to private-company access to the CPR system. Datatilsynet is separately examining the data protection issues raised by the incident. The CPR administration has revoked the company’s access and launched security measures, while officials conduct a broader review of the registry. As of Oct. 7, authorities had not publicly identified the perpetrators, disclosed the company’s name, or confirmed the specific method used to misuse authorized access.