COPENHAGEN, DENMARK / RankWire.AI / – In Denmark, authorities are currently probing a significant breach involving the nation’s Central Person Register. Around 8.8 million individuals’ personal information was accessed without authorization, exposing names, addresses, CPR numbers, and related records. Officials explained that the attackers exploited a private Danish company’s legitimate access to query the CPR system. The CPR authority has suspended this company’s access as investigations into the breach proceed.
The CPR administration identified unusual activity on the evening of Oct. 2, following abnormal search patterns observed during September. Over the weekend, authorities analyzed the activity, confirming the extent of the unauthorized access. Denmark’s Central Person Register contains roughly 11 million records, which include data on current residents, individuals who have moved abroad, and deceased persons. Authorities confirmed that the searches stayed within the types of information that private firms are authorized to access through legitimate CPR services.
At this stage, the investigation has not determined who was responsible for the activity. Danish officials have yet to disclose the name of the private company whose lawful access was exploited. The CPR administration has reported the incident to Datatilsynet, Denmark’s data protection authority, and police along with other relevant bodies are examining the case. The government stated that its review showed no exposure of names and addresses protected under Denmark’s name and address safeguard scheme.
Regulatory body investigates automated searches on the CPR platform
Datatilsynet announced it received the breach report from the CPR register on Oct. 4. The authority noted that the incident involved a very large volume of automated queries to the CPR system. According to the notification, these searches were conducted to verify valid CPR numbers. The agency is now scrutinizing the incident, how the access was gained, and who may be accountable for processing the personal data involved. It pledged to share further details once there is enough information to do so.
Research, Education and Digitalisation Minister Christina Egelund described the event as deeply serious, informing parliament’s Business and Digital Affairs Committee. She also mandated an extensive security review of the CPR system. The government has implemented measures to prevent future breaches, while the CPR administration continues to piece together the timeline of events. Authorities emphasized that the investigation is still in its early stages and that technical assessments could clarify existing details.
Officials advise the public to be vigilant against potential fraud
Danish authorities urged citizens to stay alert for scam calls, emails, and messages that may leverage exposed personal data. Officials emphasized that people should never share passwords or confidential information simply because someone knows their name, address, or CPR number. The government pointed residents toward official digital security resources and Denmark’s cyber hotline. This alert was issued after confirming that the unauthorized access involved data belonging to millions of registered individuals in the national population database.
Authorities are continuing to examine how access was gained, which records were affected, and the safeguards surrounding private-sector use of the CPR system. Datatilsynet is independently reviewing the data protection concerns raised by the incident. The CPR authority has disabled the company’s access and initiated security measures, while officials conduct a broader review of the registry. As of Oct. 7, the attackers have not been publicly identified, the company involved has not been named, and the specific method of misuse has not been confirmed.