COPENHAGEN, DENMARK / RankWire.AI / – Danish authorities are now probing a significant security breach involving the country’s Central Person Register, where unauthorized parties accessed personal information of approximately 8.8 million individuals. The compromised data included names, addresses, CPR numbers, and related records. Officials have stated that the attackers utilized legitimate access held by a private Danish company to perform searches within the CPR system. As a precaution, the CPR administration has halted the company’s access while investigations determine how the breach occurred.
The CPR administration identified suspicious activity on the evening of Oct. 2, after noticing unusual search patterns that took place in September. Over the weekend, authorities examined the activity and confirmed the extensive scope of unauthorized access. The Central Person Register contains roughly 11 million records, including details of current residents, those who have moved abroad, and deceased individuals. Officials emphasized that the searches remained within the types of information that private entities are permitted to access through authorized CPR services.
The identity of the individuals responsible for conducting the activity remains unknown, and Danish officials have not disclosed the private company whose authorized access was exploited by the attackers. The CPR administration reported the incident to Datatilsynet, Denmark’s data protection authority, and police are actively investigating in coordination with other relevant agencies. The government stated that its review did not reveal any exposure of names or addresses covered by Denmark’s protection scheme for sensitive information.
Regulator scrutinizes automated searches within the CPR system
Datatilsynet reported receiving the incident report from the CPR register on Oct. 4. The agency noted that the case involved a very high volume of automated searches targeting the CPR database, with the purpose being to verify valid CPR numbers, as outlined in the notification. The regulator is now investigating what transpired, how such access was enabled, and who might be responsible for processing the personal data involved. Further updates will be provided once there is sufficient information to do so.
Research, Education and Digitalisation Minister Christina Egelund described the incident as extremely serious and briefed parliament’s Business and Digital Affairs Committee. Additionally, she ordered a comprehensive security review of the CPR system. The government has already begun implementing measures to prevent similar incidents in the future, while the CPR administration continues to analyze the sequence of events. Officials clarified that the investigation remains in its early stages, and further technical assessments may refine the initial findings.
Officials advise public to stay vigilant against fraud schemes
Danish authorities have issued warnings urging residents to be cautious about potential scams via phone calls, emails, or messages that may leverage exposed personal details. They emphasized that individuals should never share passwords or other sensitive information solely because someone claiming to know their name, address, or CPR number contacts them. The government directed the public toward official digital security resources and Denmark’s cyber hotline for assistance. This advisory followed confirmation that the breach involved data belonging to millions registered in the national population database.
Authorities continue to analyze the breach’s entry point, the affected records, and the safeguards in place for private-sector use of the CPR system. Separately, Datatilsynet is reviewing the data protection concerns raised by the incident. The CPR administration has suspended the company’s access and initiated security protocols, while officials broaden their review of the entire registry. As of Oct. 7, the attackers have not been publicly identified, the private company involved has not been named, and the specific method of misuse remains unconfirmed.