Denmark's National Population Registry Suffers Major Data Breach
Denmark's Central Population Register (CPR) has confirmed a significant data breach that exposed the personal information of approximately 8.8 million registered individuals. The breach, discovered in early October 2026, affected residents, individuals who have moved abroad, and deceased persons whose data is stored in the national civil registry system.
The CPR system, which serves as Denmark's authoritative database for civil registration, contains sensitive personal details including full names, residential addresses, dates of birth, marital status, and unique CPR identification numbers assigned to every registered individual.
How the Breach Occurred: Abuse of Legitimate Access
According to an official announcement from the CPR administration, threat actors gained access to the registry by misusing the legitimate credentials of a private Danish company that had authorized access to the system. This unauthorized use of trusted access allowed attackers to extract sensitive data without triggering standard security alerts associated with external intrusions.
A complementary statement from the Danish Data Protection Agency provided further technical details, indicating that the attackers employed a brute-forcing technique to enumerate valid CPR numbers. Once valid identifiers were identified, the attackers systematically queried the registry to extract the corresponding personal data for each entry.
Scale and Timing of the Incident
The CPR system currently maintains records for approximately 11 million individuals. The breach impacting 8.8 million people represents roughly 80% of the total registry, indicating a widespread but not comprehensive compromise. While the security incident itself occurred during September 2026, the CPR administration did not become aware of the breach until October 2, 2026. The full scope of the impact was determined over the following weekend through internal investigation and data analysis.
Response and Mitigation Efforts
Upon discovery of the breach, immediate action was taken to revoke the private company's access to the CPR system. Danish law enforcement has launched a formal investigation into the incident, which remains active as of the latest updates.
Minister for Research, Education and Digitalization Christina Egelund emphasized the gravity of the situation, stating: "This is an extremely serious incident, which is why I have also informed Parliament’s Business and Digitalization Committee. Together with all relevant authorities, we are working to establish the full extent of the incident."
Egelund confirmed that additional security measures have been implemented to strengthen the CPR system against similar threats. Authorities have also launched public awareness efforts, including a dedicated "cyber hotline" for individuals concerned about potential exposure and online guidance available at sikkerdigital.dk.
Public Guidance and Ongoing Concerns
In response to the breach, officials have reiterated critical security advice for the public. Citizens are urged to remain vigilant against unsolicited communications and to never disclose passwords, CPR numbers, or other confidential information in response to phone calls, emails, or other outreach — even if the sender appears to possess accurate personal details such as name, address, or CPR number.
As of the publication of this report, BleepingComputer had sought further details from the Danish Data Protection Agency regarding the specific compromise of the private company's systems but had not received a response. The incident underscores ongoing challenges in securing national identity systems against sophisticated insider-threat tactics and credential abuse.
Source: BleepingComputer