COPENHAGEN, DENMARK / RankWire.AI / – Danish authorities are expanding their probe into a significant breach of the country’s Central Person Register. Unauthorized individuals gained access to personal data of approximately 8.8 million people. The compromised information included names, addresses, CPR numbers, and related records. Officials stated that the attackers exploited lawful access granted to a private Danish company to perform searches within the CPR system. The CPR administration has suspended the company’s access while investigations determine how the breach occurred.
The CPR agency detected suspicious activity on the evening of Oct. 2, following unusual search patterns in September. Over the weekend, authorities examined the activity and confirmed the extensive scope of the unauthorized access. The Central Person Register holds around 11 million records, covering current residents, individuals who have moved abroad, and deceased persons. Officials emphasized that the searches remained within the categories of information that private companies are legally permitted to access through authorized CPR services.
The identity of those responsible for the activity remains unknown. Danish officials have not disclosed the private company whose lawful access was exploited. The CPR agency reported the incident to Datatilsynet, Denmark’s data protection authority, and police are conducting investigations alongside other relevant agencies. The government stated that its review found no exposure of names and addresses of individuals registered under Denmark’s name and address protection scheme.
Regulatory body investigates automated searches within CPR system
Datatilsynet reported receiving the incident notification from the CPR register on Oct. 4. The authority noted that the case involved a large volume of automated queries targeting the CPR database. These searches aimed to verify the validity of CPR numbers, according to the notification. The regulator is now examining the circumstances, how the access was facilitated, and who may be accountable for handling the personal data. Further details will be provided when sufficient information is available.
Research, Education and Digitalisation Minister Christina Egelund called the breach deeply serious and briefed the parliament’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has initiated measures to prevent future incidents, while the CPR agency continues to trace the sequence of events. Authorities emphasized that the investigation is still in early stages and that technical reviews might clarify some details further.
Officials advise public to be vigilant against fraud
Danish authorities urged citizens to stay alert for potential scams involving phone calls, emails, or messages that might leverage exposed personal data. People are advised never to share passwords or sensitive information just because someone claims to know their name, address, or CPR number. The government pointed residents to official digital security advice and Denmark’s cyber hotline. The warning came after confirmation that the breach involved data belonging to millions registered in the national population system.
Authorities continue evaluating the breach’s access method, affected records, and privacy safeguards regarding private-sector use of the CPR system. Datatilsynet is also separately reviewing the data protection implications of the incident. The CPR administration has disabled the company’s access and implemented security measures, while officials conduct a broader review of the registry. As of Oct. 7, the authorities have not publicly identified the attackers, named the private company involved, or revealed the specific technique used to misuse authorized access.