Unidentified attackers used a private Danish company's legitimate access to the Central Person Register (CPR) to take names, addresses and CPR identification numbers on most of the people the register holds. Denmark's Ministry of Research, Education and Digitalisation disclosed the breach on 5 October 2026. Reported totals range from about 8 million (Hamer Intel) to about 8.8 million, which is the ministry's figure, repeated by BleepingComputer, SecurityWeek, The Copenhagen Post, The Next Web and The Hacker News. The ministry says its number is not yet final. The register holds about 11 million records, so roughly 80% of it was exposed. Officials call it Denmark's largest recorded data breach. Police are investigating, and no suspect has been named.
What Happened
All sources agree that no vulnerability in the CPR system was exploited. Under Danish law, private companies with a legitimate interest can look up specific individuals in the CPR, and they pay for each lookup. Attackers used one small Danish company's valid login to run queries over about 10 days in September, according to Minister Christina Egelund speaking to Ritzau (via The Hacker News). CSIS Security Group says the login was valid, the queries stayed within the data private companies are allowed to see, and security monitoring did not flag the activity.
Timeline, compiled from the ministry statements reported by CSIS, Conscia, The Next Web and The Hacker News:
- September: About 10 days of automated lookups through the company's account.
- Friday 2 October (evening): During invoicing, the CPR administration saw an unusually large bill and spotted irregular activity. "It is during invoicing on Friday evening that a very, very large amount is billed," ministry department head Mikkel Leihardt said (The Next Web).
- Saturday 3 October: Officers from the National Unit for Special Crime visited the company to secure evidence (The Next Web).
- 3–4 October: The administration confirmed how many records were involved and notified Datatilsynet, the Danish Data Protection Agency, on 4 October (Conscia, The Hacker News).
- Monday 5 October: Public disclosure. The company's access was revoked and the minister ordered a full security review of the CPR system.
- Tuesday 6 October: At a press briefing, officials said there had been well over 14 million lookup attempts. Police said they had identified and charged no one and were contacting police in other countries.
The ministry has not named the company. It has not said how attackers gained control of the company's access, whether they kept or used the data, or who they are (The Hacker News).
What Was Taken
The confirmed data is names, addresses and CPR numbers. CPR numbers are Denmark's equivalent of a Social Security number. The affected records cover living residents, people who have moved abroad and people who have died. Denmark has only about 6 million residents (The Next Web), which is why the totals are larger than the population.
The ministry also refers to "other information" in the register. The CPR can hold marital status, birth registration details, family relationships, membership of the Church of Denmark and information on legal incapacitation. The ministry has not said which of these extra fields were accessed in each case (The Copenhagen Post). People registered for name and address protection were not exposed, according to the review so far (SecurityWeek, The Copenhagen Post).
Datatilsynet describes the records as "allegedly retrieved" and has not yet completed its own assessment (The Hacker News).
Why It Matters
The CPR number underpins Danish tax, healthcare, banking and public services. Conscia notes that this is an exposure of an entire national identity system, not of one organisation. On 6 October the Danish Agency for Civil Protection said CPR numbers can no longer be relied on to identify a person (CSIS). That changes how Danish organisations need to verify identity.
Unlike a password, a CPR number cannot simply be rotated, so the fraud risk will last for years. Name, address and ID number together are enough to support account-opening fraud, loan applications, mail redirection and convincing phishing. The ministry has warned citizens never to give passwords or confidential information to anyone who calls or emails, even if the caller already appears to know their details (The Hacker News).
The case also shows how third-party access to government data can be abused. The attacker needed no exploit, and the abuse went unnoticed by security monitoring. Billing was what caught it.
The Attack Technique
Datatilsynet says the attackers made a very large number of automated lookups to find valid CPR numbers, then pulled the record for each valid hit (BleepingComputer, The Hacker News). This was enumeration through a legitimate query interface. Officials say the account made well over 14 million lookup attempts and about 8.8 million returned a record (The Next Web, CSIS).
How the company's credentials or systems were compromised has not been confirmed in any of the reporting reviewed here. CSIS and Conscia both describe it as misuse of trusted third-party access, which is one of the hardest attack patterns to detect because each query looks authorised.
What Organizations Should Do
- Monitor volume and rate on third-party API access. Set baselines for each partner's normal query volume and alert on deviations in hours, not at the end of the billing cycle. Here, 14 million lookups in 10 days went unflagged.
- Detect enumeration patterns. Sequential or high-miss-rate lookups (attempts far exceeding successful hits) are a strong sign of brute-force discovery of identifiers and should trigger automatic throttling or suspension.
- Enforce strong authentication for every external consumer of sensitive registers. Require phishing-resistant MFA, credential hygiene standards and periodic access recertification as conditions of access.
- Apply hard quotas that match each partner's legitimate business need. A small company has no plausible reason to query most of a national register. Cap access accordingly.
- Stop treating CPR numbers (and similar national IDs) as proof of identity. Banks, insurers and service providers should require stronger verification for account opening, changes of address and password resets.
- Prepare for targeted phishing. Brief staff and customers that attackers may already know names, addresses and ID numbers, and that knowing these details proves nothing about who is contacting them.
Sources: Data on 8 Million People Stolen in Denmark’s Largest Recorded… | Denmark population registry data breach affects 8.8 million people | 8.8 Million Impacted by Data Breach at Denmark's Central ... | CPR breach: misuse of trusted access CSIS Security Group | CPR data breach exposes personal details of 8.8 million people in D... | Trusted access, untrusted volume: the Danish CPR register incident... | Denmark’s CPR breach: 14 million lookups in ten days, found through... | Denmark Says Attackers Accessed CPR Data for 8.8 Million People via...