COPENHAGEN, DENMARK / RankWire.AI / – The Danish Data Protection Agency, Datatilsynet, is currently investigating a significant security breach involving the country’s Central Person Register. Unauthorized individuals accessed personal information related to approximately 8.8 million people. The compromised data comprised names, addresses, CPR numbers, and associated records. Officials confirmed that the attackers exploited legitimate access granted to a private Danish company to search the CPR database. The CPR authorities have suspended the company’s access as investigations into the incident continue.
The CPR administration identified suspicious activity on the evening of Oct. 2, following unusual search patterns observed during September. Over the weekend, authorities reviewed the activity and verified the extent of the unauthorized access. Denmark’s Central Person Register holds around 11 million records, including current residents, individuals who have moved abroad, and those who have passed away. Officials emphasized that the searches remained within categories of data that private firms are authorized to access via approved CPR services.
The identity of the perpetrators has not been determined, and Danish officials have not disclosed the private company involved whose lawful access was exploited. The CPR administration reported the incident to Datatilsynet, Denmark’s data protection authority, and police are conducting investigations alongside other relevant agencies. The government stated that its review found no exposure of names and addresses protected under Denmark’s name and address protection scheme.
Data regulator reviews automated CPR data searches
Datatilsynet announced it received the incident report from the CPR register on Oct. 4. The authority indicated that the case involved an extensive number of automated queries targeting the CPR system. According to the notification, these searches aimed to verify valid CPR numbers. The regulator is currently examining the circumstances, how access was gained, and who might be responsible for processing the personal data involved. Further information will be provided once a clear understanding has been established, Datatilsynet added.
Research, Education and Digitalisation Minister Christina Egelund described the incident as highly serious and briefed parliament’s Business and Digital Affairs Committee. She also mandated a comprehensive security review of the CPR system. The government has initiated measures to prevent future breaches, while the CPR administration continues to analyze the sequence of events. Authorities noted that the investigation is still in its early stages and that technical assessments may refine initial findings.
Public advised to remain cautious about fraud attempts
Officials in Denmark urged residents to be vigilant against fraudulent calls, emails, or messages that could leverage exposed personal information. They emphasized that individuals should never share passwords or sensitive details just because someone claiming to know their name, address, or CPR number contacts them. The government recommended consulting official digital security resources and Denmark’s cyber hotline for assistance. The warning was issued following confirmation that the breach involved data belonging to millions registered in the national population registry.
Authorities are actively evaluating the breach route, impacted records, and the safeguards surrounding private-sector use of the CPR system. Datatilsynet is conducting a separate review regarding data protection concerns raised by the incident. The CPR administration has revoked the company’s access and implemented security measures, while officials continue to examine the registry’s overall security. As of Oct. 7, the attackers’ identities, the company involved, and the specific method used to exploit authorized access remain undisclosed.