COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are currently investigating a significant security breach involving the country’s Central Person Register. About 8.8 million individuals’ personal data were accessed without authorization. The compromised data included names, addresses, CPR numbers, and related records. Officials explained that the attackers exploited legitimate access granted to a private Danish company to search the CPR database. The CPR administration has halted this company’s access pending further investigation into how the breach occurred.
The CPR administration identified suspicious activity on the evening of Oct. 2 after unusual search patterns were detected during September. Over the weekend, authorities reviewed these activities and confirmed the extent of the unauthorized access. The Central Person Register holds roughly 11 million records, covering current residents, individuals who have moved abroad, and deceased persons. Officials emphasized that the searches fell within the categories of information that private firms are permitted to access through authorized CPR services.
The investigation has not yet determined who was responsible for executing the activity. Danish officials also have not disclosed the identity of the private company whose authorized access was exploited. The CPR administration reported the incident to Datatilsynet, Denmark’s data protection agency. Meanwhile, police are working with other relevant authorities to investigate. The government stated that its review found no evidence of names or addresses belonging to individuals protected under Denmark’s name and address protection scheme being exposed.
Regulatory body scrutinizes automated CPR system queries
Datatilsynet reported it received the incident notification from the CPR register on Oct. 4. The authority indicated that the breach involved a very high volume of automated searches against the CPR system. According to the notification, these searches aimed to verify valid CPR numbers. The regulator is now examining the incident, including how the system access was gained, what occurred, and who might be accountable for processing the personal data involved. It added that further details will be provided once more information becomes available.
Research, Education and Digitalisation Minister Christina Egelund characterized the event as highly serious and briefed Denmark’s parliament’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has initiated measures to prevent recurrence, while the CPR administration continues to trace the sequence of events. Authorities noted that the investigation is still in its early stages, and technical assessments may refine the known facts.
Officials caution public against scams using exposed data
Danish authorities urged citizens to remain vigilant against scams involving fraudulent phone calls, emails, and other messages that may leverage the exposed personal information. They emphasized that individuals should never share passwords or sensitive details simply because someone claims to know their name, address, or CPR number. The government directed residents to official digital security resources and Denmark’s cyber hotline. This warning followed confirmation that the unauthorized access involved data belonging to millions of individuals registered within the national population system.
Authorities continue to analyze the breach route, the affected records, and the security measures surrounding private-company use of the CPR system. Additionally, Datatilsynet is independently reviewing the data protection issues raised by the incident. The CPR administration has suspended the company’s access and implemented security protocols, while officials conduct an extensive review of the registry. As of Oct. 7, the attackers’ identities remain undisclosed, the private company’s name has not been revealed, and the precise method of misuse remains unconfirmed.