The Denmark population registry breach has exposed personal information belonging to approximately 8.8 million people. Authorities say attackers misused a private Danish company’s legitimate access to the Central Population Register, known as CPR.
The affected records include current residents, people who have moved abroad and deceased individuals. Consequently, the total does not represent 8.8 million people currently living in Denmark.
Officials have blocked the company’s access, while police investigate how the attackers obtained and abused it.
Attackers Misused a Company’s Registry Access
The CPR serves as Denmark’s national civil registry. It holds information such as names, addresses, dates of birth, marital status and unique CPR identification numbers.
According to the official announcement, attackers used a private company’s authorized connection to retrieve names, addresses, CPR numbers and other information.
However, authorities have not yet explained how the attackers gained control of that access. The available account also does not identify the company involved.
Separately, the Danish Data Protection Agency said the incident involved a form of brute-force enumeration. Attackers identified valid CPR numbers and then retrieved information associated with those entries.
This description points to repeated lookups of registry records. It does not, by itself, establish that attackers guessed account passwords.
Approximately 80% of Registry Records Affected
The registry contains records for around 11 million individuals. With approximately 8.8 million affected, the Denmark population registry breach reaches roughly 80% of that total.
However, authorities say the incident did not affect everyone in the system.
The unauthorized activity occurred in September 2026. CPR administrators learned of the breach on October 2 and established its approximate scale over the following weekend.
Authorities subsequently blocked the private company’s access to prevent further use of that connection. Meanwhile, the police investigation remains underway.
Government Introduces Additional Security Measures
Christina Egelund, Denmark’s minister for research, education and digitalization, described the incident as extremely serious. She also informed Parliament’s Business and Digitalization Committee.
According to Egelund, relevant authorities are working together to establish the full extent of the breach.
Officials have also introduced additional security measures intended to prevent similar incidents. However, the announcement did not provide technical details about those changes.
Questions therefore remain about the initial compromise and the complete range of information the attackers obtained.
Residents Warned About Convincing Scam Messages
Authorities urged residents to remain alert to unsolicited calls, emails and other communications following the breach.
In particular, knowing someone’s name, address or CPR number does not prove that a caller or sender is legitimate. Attackers could use exposed details to make fraudulent messages appear more credible.
The official guidance warns people never to disclose passwords or other confidential information in response to such contact.
Meanwhile, a dedicated cyber hotline offers assistance to potentially affected individuals. Authorities have also made guidance available through Denmark’s national digital safety website.
0 responses to “Denmark Population Registry Breach Exposes Data of 8.8 Million People”