Denmark Says Attackers Took CPR Records on 8.8 Million People

On Monday, October 5, 2026, Denmark's Ministry of Research, Education and Digitalisation disclosed that unauthorized parties had obtained records on about 8.8 million people from the Central Person Register, the CPR. TechCrunch described it as the biggest data breach in Danish history. The register is the identity layer under Danish life, and what was taken was names, addresses and CPR numbers.

Related reading: Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records · Capcom Says a Breach Exposed 11.7 Million CAPCOM ID Records and Let an Attacker Change 196 Passwords.

The way in was mundane. Nobody defeated encryption or broke into a hardened server. The attackers abused the lawful access of a small Danish company that was allowed to search the register, according to the ministry. More than 14 million automated lookups ran through that one company's access over about ten days in September 2026, and about 8.8 million of them returned a record. The company's access has since been cut off. Valid credentials, used at machine speed, turned an access-control failure into a national incident.

What the CPR is, and why 80% is the number that matters

The CPR is Denmark's civil registration system, and the ministry's figures show how much of it was touched.

• The register holds records on about 11 million people. That includes current residents, people who have moved abroad, and the deceased.
• About 8.8 million of those records were affected, roughly 80% of the register.
• Denmark's current population is just over 6 million.

The gap between 8.8 million and 6 million is the first thing to understand. The figure counts records, not living residents. A person who died years ago or moved away still has a CPR record, and theirs can be caught in the same sweep. The Record, Help Net Security and The Next Web carry the 8.8 million figure. TechCrunch's headline and lede used "8 million" for the same event, so readers will meet both numbers.

One group was excluded. The ministry said the breach did not include people who had registered name and address protection, a setting that keeps an address off public listings.

Reaching roughly 80% of a register the state has kept for decades is unusual. Most breaches of a public database expose a slice chosen by a business process, a set of customer accounts, or a single department. This one cut across almost the whole file in a matter of days.

The CPR number is the point

The CPR number is Denmark's national identifier. The same number follows a person through tax filing, healthcare and banking, and the leaked record ties it to a name and an address. That pairing is what makes the data useful to an attacker. Unlike a password, it is not confined to one service. The Hacker News noted the breadth of uses the number spans.

For the people in the register, the risk runs downstream. A leaked CPR number does not by itself open an account, and it does not by itself grant entry to a bank or a health portal. Combined with a name and an address, though, it is the raw material that identity fraud and convincing phishing are built on. What an attacker now holds is a stable piece of someone's civic identity, and unlike a password it does not change.

What a person can do after that number leaks is a harder question than resetting a password. The ministry has not yet set out an answer for 8.8 million records, and the disclosure carried no advice from the authorities on replacement, monitoring or fraud checks.

From an invoice to a national alert

The timeline the ministry and the CPR administration gave is short and specific.

• The CPR administration learned of irregular activity on the evening of Friday, October 2, 2026, when an employee noticed it. The scale was established over the weekend.
• Officers from the National Unit for Special Crime visited the company on Saturday evening, October 3, 2026, to secure evidence.
• The administration notified the Danish Data Protection Agency, Datatilsynet, on Sunday, October 4, 2026.
• Datatilsynet published its notice on October 5, the same day the ministry went public.

The activity was ultimately noticed through an invoice or a bill, according to accounts of the case. Whether that means the abuse surfaced in billing records, in a cost anomaly, or in a routine review is not clear from the public statements. What the detail does show is that the lookups blended in for long enough to need after-the-fact detection. The ten-day window is the scale of that gap.

Danish digitalisation minister Christina Egelund called it "a deeply serious incident."

A deeply serious incident.

No suspects, and a case still open

As of the disclosure, police had identified no one and charged no one. Henriette Erbs, who heads the National Unit for Special Crime, said her officers were contacting police in other countries. The ministry would not say who was behind the breach.

The exploited company has not been named publicly, and no motive has been given. That leaves the central questions open. It is not known whether this was an attempt to assemble a bulk identity database, a step toward fraud, or something else, and the ministry has not said whether the data has already changed hands, been sold, or sat unread.

What the ministry has said is narrower: that a company's access was misused, that the lookups ran for about ten days, and that the access has been closed. It has not explained how the misuse went unnoticed, or what, if anything, the company itself did.

Investigators have moved quickly on the parts they can control. The National Unit for Special Crime secured evidence at the company the day after the activity was spotted, and the notification to Datatilsynet followed within two days. The open items are the slower ones: attribution, motive and the fate of the data. A register breach of this size also raises the question of who answers for it, which no Danish authority has addressed in public yet.

The 2015 echo

Denmark has been here before, at a smaller scale. In 2015, two unencrypted CDs holding CPR data on more than 5 million people were mistakenly delivered to the Chinese Visa Application Centre in Copenhagen. Authorities said at the time there was no evidence the data had been copied or leaked. That incident was a courier mistake. This one, on the ministry's account, was an outside party using a company's legitimate access to search the register at volume, and the access stayed live for about ten days before it was shut down.

The two events differ in method and in what followed. The 2015 case raised questions about how physical media moved between offices. This one raises questions about how digital access to the register is watched. In both, the data left through a path the state had approved, and in neither did an outsider have to break in.

Why an access failure is the hard case

Most breach stories end in a patched product or a corrected configuration. This one ends in a question about the access model itself.

The register has to be searchable. Companies and public bodies with lawful access need to query it for the work they do, and the ministry has said the number is used across taxes, healthcare, banking and other services. The breach did not require anyone to defeat that design. It required only that one holder of access be turned against the register or be compromised. Catching that means watching both who has access and how much of the register each one touches, and how fast. A single account pulling millions of records in ten days is a pattern. Why an invoice, rather than monitoring, surfaced it is the question the case leaves open.

The hard part is structural. A search interface that answers millions of queries in ten days works as intended for each single query. The anomaly appears only in aggregate, in the pattern of who is asking and how often. Catching it means logging and rate analysis across every organisation granted access, which is easier to write into policy than to enforce.

The ministry has not said how the company's access came to be misused, or whether an insider, a compromised account or a misconfigured integration was responsible. Until it does, the incident shows that a register can be emptied through a door that was opened on purpose.

What to watch

Whether the investigation names anyone, and whether it crosses borders. Erbs said her unit is contacting police in other countries, the clearest signal so far that the trail points outside Denmark. A cross-border case would also test how Danish authorities work with foreign police over data taken from a national register.

Whether Datatilsynet's review confirms the scale. The agency had not finished its assessment when the ministry went public, and its "allegedly retrieved" wording leaves room for the figure to move. If the confirmed number falls, so does the chance that this stays the country's largest breach.

What the register operator changes. The company's access has been cut off, but the ministry has not described new limits on how much of the CPR any single holder can query. That is the control that would have narrowed this incident from the start, and it is the one most likely to be debated.

And what affected people are told to do. With names, addresses and CPR numbers in circulation, the official response for 8.8 million records will say as much about Danish readiness as the breach itself. The ministry has described the incident and the response so far, but not the guidance that comes after it.

Feature image: Moahim, Wikimedia Commons, CC BY-SA 4.0.