Denmark CPR Breach Exposes 8.8 Million Records Through Weak Credentials

The Denmark CPR breach occurred when attackers exploited weak passwords on accounts belonging to Pays ApS, a small IT firm in Odense with legitimate access to the national civil register. No direct intrusion into CPR infrastructure took place. The incident exposed names, addresses, and 10-digit CPR numbers for approximately 8.8 million individuals, including living residents, deceased persons, and emigrants.

Activity ran from roughly 10 to 20 September 2026, with more than 14 million automated queries. Detection happened only on 2 October after an unusually large invoice triggered review. The Ministry of Research, Education and Digitalisation announced the breach publicly on 5 October.

How the Unauthorized Queries Were Executed

Three Pays ApS accounts, including an administrator account, used the password “123456” and lacked two-factor authentication. Credentials had reportedly appeared in a prior public data leak tied to a former employee. Attackers used scripts to automate lookups after gaining entry through these accounts.

The firm confirmed its access rights were misused but stated it did not perform the queries itself. An anonymous individual later contacted Politiken and verified possession of the data by sharing a sample covering 8.75 million people. That person claimed no intention to sell or further distribute the information.

Exposed fields centered on names, addresses, and CPR numbers. Records of individuals with name-and-address protection remained untouched. Some queries could also return marital status or family relations depending on the access level granted to the company.

Response from Authorities and Next Steps

Officials immediately revoked Pays ApS access. The case was reported to Datatilsynet and referred to the National Unit for Serious Crime. Digitalisation Minister Christina Egelund called the incident deeply serious and ordered a full security review of the CPR system.

Security guidance was sent to all 1,039 companies holding CPR access, requiring designated security officers, improved logging, and transaction monitoring. CPR numbers can no longer be treated as sole identifiers in many contexts. Citizens are advised to monitor accounts for fraud through resources at sikkerdigital.dk.

A comprehensive security audit continues, with results expected soon. Potential outcomes include new identification methods and stricter controls on third-party access. The breach remains under active police investigation as of 22 October 2026.

Practical Implications for Users of CPR Data

Organizations relying on CPR numbers for verification should add secondary checks such as address confirmation or biometric elements. Individuals whose data was exposed face elevated risk of identity-related fraud and should review bank and government accounts regularly.

The incident underscores the need for strong authentication and volume monitoring even on legitimate third-party connections. Until the security review concludes, reliance on CPR numbers alone carries documented limitations.