According to The Record, the Danish government said on October 5 that someone exploited an unnamed Danish company's legitimate access to the Central Person Register (CPR) to obtain the names, addresses and CPR numbers of about 8.8 million people [1]. Officials said irregular activity was first detected the previous Friday and the breach occurred in September, while the Danish Data Protection Agency described a very large number of automated searches aimed at identifying valid CPR numbers; no perpetrator has been named [1]. People in Denmark can call the government's digital security hotline, extended to 8 a.m. to midnight, and should watch for identity misuse involving CPR numbers [1].
Misused supplier access to Denmark's national population register exposes names, addresses and CPR numbers of about 8.8 million people
1 min read
- Disclosed
- Oct 5, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 8,800,000 people[1]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
Timeline
- Danish government discloses CPR register breach[1]
Technical details
Remediation
Vendor guidance
- 1Watch for identity misuse detect[1]
Watch for misuse of CPR numbers, names and addresses; call the digital security hotline with concerns.
References
Media1
- [1]
“The perpetrators exploited an unnamed domestic company’s legitimate access to Denmark’s Central Person Register (CPR) to compromise names, addresses and CPR numbers”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.