Denmark CPR Breach Exposes 8.8 Million Records in Central Person Register

The Denmark CPR breach in October 2026 exposed names, addresses, and CPR numbers for approximately 8.8 million records held in the Central Person Register. The incident occurred through misuse of an authorized third-party account rather than a direct intrusion into the registry infrastructure. Official disclosure came on October 5, 2026, after irregular activity was identified in early October.

Timeline and Scale of the Denmark CPR Breach

Irregular queries began around September 10, 2026, and continued for roughly ten days. More than 14 million automated lookups occurred before access ended near September 20. The CPR administration detected the activity on October 2 through an unusually large invoice for data services and confirmed the full scope over the following weekend.

The Ministry of Research, Education and Digitalisation announced the incident publicly on October 5. The breach affected records of living residents, deceased individuals, and emigrants, exceeding Denmark’s current population of about six million. The register itself contains roughly 11 million total entries.

Credit monitoring services reported a sharp rise in warnings after disclosure, increasing from roughly 250,000 to 970,000 in the weeks that followed. Authorities blocked the compromised account immediately and notified the Danish Data Protection Agency.

Access Method and Identified Security Gaps

Attackers obtained credentials belonging to Pays ApS, a small company in Odense with legitimate query rights for services such as address verification. The company confirmed the account was used for bulk lookups far beyond its normal volume. Reports indicated the credentials originated from a prior employee data leak, with some accounts protected by weak passwords.

No evidence points to a compromise of CPR servers themselves. Protected name and address fields remained inaccessible. The incident revealed insufficient real-time monitoring of query volumes across the 1,039 other authorized companies that hold similar access.

Digitalisation Minister Christina Egelund described the event as deeply serious and stated that overall security had not been adequate. The ministry ordered a comprehensive review of the entire CPR system, including consideration of new identification numbers or structural redesign. Security reminders were issued to all authorized entities, and manual oversight was introduced pending automated improvements.

Current Protections and Practical Steps for Individuals

The CPR system, established in 1968, assigns unique 10-digit identifiers used across public services and banking. Private firms with documented need can receive query access, yet the breach showed that volume-based alerts were absent. The ongoing police investigation, led by the National Unit for Serious Crime, has not yet identified the individuals responsible or confirmed whether data has been sold.

Citizens can monitor accounts through official channels such as sikkerdigital.dk and request credit freezes where available. The ministry has not ruled out issuing replacement CPR numbers but stated that any decision requires completion of the current security audit, expected to conclude in coming months. Organizations handling Danish personal data should review their own access logs for similar third-party dependencies.

Authorities continue to map the full extent of queries performed and any downstream use of the obtained records. No public leaks beyond the initial claims have been verified as of October 19, 2026.