COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are probing a significant security breach within the country’s Central Person Register. Personal information associated with approximately 8.8 million individuals was accessed without authorization. The compromised data included names, addresses, CPR numbers, and related records. Officials confirmed that the attackers exploited a private Danish company’s legitimate access to search the CPR system. The CPR administration has suspended the company’s access as investigations into the incident continue.
The CPR administration detected irregular activity on the evening of Oct. 2 after unusual search patterns occurred during September. Over the weekend, authorities reviewed this activity and confirmed the extensive scope of unauthorized access. The Central Person Register in Denmark holds roughly 11 million records, covering current residents, individuals who have relocated abroad, and deceased persons. Officials clarified that the searches were limited to data types that private companies are legally permitted to access via authorized CPR services.
The identity of the individuals responsible for carrying out the activity remains unknown. Danish authorities have not disclosed the name of the private company whose lawful access was exploited by the attackers. The incident was reported to Datatilsynet, Denmark’s data protection authority, and police are conducting investigations alongside other relevant agencies. The government’s review found that no names or addresses protected under Denmark’s name and address protection scheme were exposed.
Regulatory body investigates automated CPR queries
According to Datatilsynet, the incident report from the CPR register was received on Oct. 4. The regulator noted that the case involved a very large volume of automated searches targeting the CPR system. These searches aimed to validate CPR numbers, as outlined in the notification. The agency is now examining the circumstances that allowed such access, identifying responsible parties, and determining what happened during the breach. Further information will be provided once sufficient details are available.
Research, Education and Digitalisation Minister Christina Egelund described the incident as extremely serious and briefed Denmark’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has begun implementing measures to prevent recurrence, while the CPR administration continues to piece together the sequence of events. Authorities emphasized that the investigation is still in its early stages and that technical reviews may further clarify key details.
Public advised to be vigilant against fraud
Danish officials have urged residents to stay alert for scam attempts involving phone calls, emails, or messages that may leverage exposed personal data. They emphasized that individuals should not share passwords or any sensitive information just because someone claims to know their name, address, or CPR number. The government directed citizens to official digital security resources and Denmark’s cyber hotline. This warning followed confirmation that the breach involved data belonging to millions of individuals registered in the national population database.
Authorities are still evaluating how access was gained, the records affected, and the security measures regarding private-sector use of the CPR system. Datatilsynet is separately reviewing the data protection implications of the incident. The CPR administration has revoked the private company’s access and initiated security protocols, while officials conduct a broader review of the register. As of Oct. 7, the authorities had not publicly identified the attackers, named the involved company, or confirmed the specific method used to misuse the authorized access.