COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are probing an incident involving unauthorized access to personal information stored within the country’s Central Person Register, known as CPR. The breach compromised records linked to approximately 8.8 million individuals. The information accessed included names, addresses, CPR identification numbers, and other registered details. Officials confirmed that the intruders used credentials associated with a private Danish company that had legitimate permission to search the national population database. The company’s name has not been disclosed.
The CPR administration detected irregular activity on the evening of Oct. 2, following a series of searches conducted during September. Over the subsequent weekend, officials reviewed the activity and assessed the extent of the access. The CPR database in Denmark holds about 11 million entries, encompassing current residents, those who have moved abroad, and deceased individuals. Authorities emphasized that the searches remained within information categories available through authorized CPR services.
The individuals responsible for the unauthorized searches have yet to be identified. After discovering the suspicious activity, the CPR administration revoked the company’s access. Danish police and other agencies are investigating how the breach occurred and which records may have been accessed. Additionally, officials examined whether the protected names and addresses under Denmark’s name and address protection scheme were involved. It was confirmed that protected information did not form part of the data exposed.
Data oversight body evaluates automated CPR inquiries
Datatilsynet, Denmark’s data protection authority, received notification of the incident on Oct. 4. The authority stated that a significant number of automated searches had been carried out against the CPR system. The notification indicated that these searches aimed to validate CPR numbers. Datatilsynet is now investigating how unauthorized individuals gained access and what personal data was retrieved. The review also considers the responsibilities related to processing the affected data under Danish data protection legislation.
Research, Education and Digitalisation Minister Christina Egelund described the incident as extremely serious and briefed the parliament’s Business and Digital Affairs Committee. She ordered a comprehensive security assessment of the CPR system and its access controls. The government has initiated measures aimed at reducing the likelihood of similar breaches in the future. Authorities are continuing to trace the incident’s sequence of events and review the safeguards used by private entities with authorized access to CPR data.
Public advised to remain vigilant against scams
Residents of Denmark have been advised by authorities to be cautious of potential scam calls, emails, and messages that may contain exposed personal data. Officials cautioned people against sharing passwords or sensitive information, especially when contacted by someone who already knows their name, address, or CPR number. The government recommended consulting official digital security resources and Denmark’s cyber hotline for guidance. It remains unconfirmed whether the accessed information has been exploited for fraud, identity theft, or other criminal acts beyond the unauthorized searches.
Investigation teams are still analyzing the access pathways, the records affected, and the security protocols governing private use of the CPR database. The identity of the company involved and the specific method of misuse remain undisclosed. Authorities have also not publicly identified those responsible for the unauthorized searches. As of Oct. 7, the CPR administration, police, and regulators continued separate inquiries into the incident, while Denmark evaluated the security framework protecting its national population registry.