Denmark’s CPR Data Breach Exposes 8.8 Million Records in Record Cyberattack

Denmark’s government confirmed on 5 October that its Central Person Register (CPR) — the identity database at the heart of the country’s highly digitised public sector — was compromised and most of its contents stolen. Officials have labelled it the most serious cyber incident in Danish history. Depending on the figure cited, between 8 million and 8.8 million registered people are affected, a count that includes citizens living abroad and the deceased.

• Scale: The register holds records on roughly 11 million people against a living population of about six million, meaning nearly every living Dane sits inside the exposed dataset.
• Attack vector: There was no frontal assault on state systems — intruders abused the legitimate CPR lookup access held by a private Danish company.
• What leaked: Full names, addresses and 10-digit CPR numbers, identifiers that cannot be reissued and that underpin tax, healthcare and banking.
• Timing: Unauthorised activity ran through September and was only detected on 2 October, with the Danish Data Protection Agency notified two days later.

A Number That Cannot Be Reset

The CPR is not a customer database. It is the identity spine of the Danish state, holding decades of historical records alongside current ones. Every resident receives a unique 10-digit CPR number beginning with their date of birth, used to pay taxes, access healthcare, open accounts and claim benefits.

What makes the exposure so dangerous is its permanence. A leaked password can be rotated, a compromised card cancelled. A national identification number cannot be reassigned, so once CPR numbers circulate they stay usable for identity fraud, highly targeted phishing and impersonation for years. The closest precedent in scale is India’s Aadhaar system, where hundreds of millions of records leaked across multiple incidents between 2018 and 2022, with some data surfacing on criminal markets only years later. Comparable population-scale registry exposures have also hit Turkey in 2016 and Argentina in 2021.

Denmark has faced a smaller version of this before: in 2015, two unencrypted CDs carrying CPR data on more than five million people were mistakenly delivered to the Chinese Visa Application Centre in Copenhagen.

The Breach Arrived Through a Trusted Supplier

The access route matters as much as the volume. The government says unauthorised parties got in by abusing a Danish company’s lawful access to search the CPR system. Several private Danish firms legitimately hold query rights to the register to verify customer identities — a delegated-access model common across the digitally integrated Nordic administrations. No direct compromise of state infrastructure was required; the trust channel was already open.

“This incident demonstrates the inherent risk of highly centralized national databases when private companies are granted direct access to sensitive records. A compromised account at a single supplier can bypass an organisation’s core security controls and turn a legitimate connection into a massive data exposure.” — Dray Agha, senior manager of security operations at Huntress

Nathan Davies-Webb, a principal consultant at Acumen Cyber, said systems like this “should be treated with the utmost importance,” while calling the government’s transparency — including extended hours on the national digital security hotline, running from 8 a.m. to midnight — a positive sign that response plans are being followed.

On timing, irregular activity was first spotted on Friday 2 October; investigators then determined the unauthorised searches had taken place during September, with Danish media reporting cited in later coverage suggesting the operation ran for roughly ten days before detection. The government has not attributed the attack and has not confirmed whether ransomware was involved. Records of people registered for name-and-address protection were not exposed, and the company’s CPR access has since been suspended pending the police inquiry.

Regulatory Reckoning and Thin Remedies for Victims

As an EU member, Denmark falls under the General Data Protection Regulation. Regulators must establish whether the responsible bodies met their security obligations, and penalties can reach 4% of global annual turnover. Digital affairs minister Christina Egelund has ordered a comprehensive security review of the CPR system.

“This is a deeply serious incident. Together with all the relevant authorities, we are in the process of mapping out the full extent of the incident.”

For affected individuals, practical options remain limited: monitor credit histories, enable alerts wherever CPR usage can be tracked, and treat unsolicited calls or messages that display accurate personal details with heightened suspicion. Egelund has urged Danes to stay vigilant about suspicious contacts, but has not issued specific remediation steps beyond staying informed.

The open questions are substantial — no company name, no attribution, no estimate of how much stolen data is already circulating. What the incident already shows is that delegated third-party access to civil registries is critical infrastructure operating with less technical auditing than its sensitivity demands. Denmark spent decades building one of the world’s most integrated digital states, only to be undone through one of its own trust relationships. Closing that gap will require rethinking who gets to query citizen identity data — and how closely they are watched.