COPENHAGEN, DENMARK / RankWire.AI / – Danish authorities are investigating unauthorized access to personal data in the country’s Central Person Register, known as CPR. The incident affected records linked to about 8.8 million people. Accessed information included names, addresses, CPR identification numbers and other registered details. Officials said the attackers used credentials connected to a private Danish company with legitimate permission to search the national population system. Authorities have not named that company.
The CPR administration detected unusual activity on the evening of Oct. 2 after a series of searches during September. Officials reviewed the activity over the following weekend and established the scale of the access. Denmark’s CPR database contains about 11 million records in total. The system covers current residents, people who have moved abroad and deceased individuals. Officials said the searches remained within categories of information available through authorized CPR services.
Authorities have not identified those responsible for the unauthorized searches. The CPR administration terminated the company’s access after detecting the suspicious activity. Danish police and other authorities are investigating how the breach occurred and which records were accessed. Officials also examined information protected under Denmark’s name and address protection scheme. They confirmed that protected names and addresses under that program were not part of the exposed data.
Data protection agency assesses automated CPR queries
Datatilsynet, Denmark’s data protection authority, received the incident report on Oct. 4. The agency stated that a significant number of automated searches had targeted the CPR system. According to the report, these searches aimed to verify the validity of CPR numbers. Datatilsynet is investigating how unauthorized entities gained access and what personal information they retrieved. The review also considers responsibilities related to data processing under Danish data protection regulations.
Research, Education and Digitalisation Minister Christina Egelund described the breach as highly serious and briefed parliament’s Business and Digital Affairs Committee. She ordered a comprehensive security review focusing on the CPR system and its access controls. The government has also initiated steps aimed at minimizing the risk of future incidents. Authorities continue to analyze the sequence of events and scrutinize security protocols employed by private organizations granted authorized access to CPR data.
Public advised to remain vigilant against potential fraud
Danish officials called on residents to be cautious about fraudulent calls, emails, and messages that might include exposed personal data. They warned against sharing passwords or sensitive information, especially if the caller claims to already know their name, address, or CPR number. The government directed citizens to official digital security advice and Denmark’s cyber hotline. Authorities have not confirmed whether the accessed information has been exploited for fraud, identity theft, or other crimes beyond the unauthorized searches.
Investigators continue to examine how the breach occurred, which records were accessed, and the security measures governing private use of the CPR system. The identity of the company involved or the specific method used to abuse its authorized access remains undisclosed. Authorities have not publicly identified the individuals behind the searches. As of Oct. 7, the CPR administration, police, and regulators were independently reviewing the incident while Denmark assessed security around its national population register.