COPENHAGEN, DENMARK / RankWire.AI / – The incident resulted in the exposure of personal records for approximately 8.8 million individuals, prompting Danish authorities to scrutinize how unauthorized access occurred within the country’s Central Person Register, known as CPR. The breach involved information such as names, addresses, CPR identification numbers, and other registered details. Officials confirmed that the attackers used credentials linked to a private Danish company authorized to search the national population database. The company’s identity has not been disclosed.
Authorities identified suspicious activity on the evening of Oct. 2, following a series of searches carried out in September. After reviewing the activity over the subsequent weekend, officials confirmed the extent of the access. The CPR system contains roughly 11 million records, including current residents, individuals who have emigrated, and deceased persons. Officials stated that the searches were confined to categories of information accessible through authorized CPR services.
The people responsible for the unauthorized searches have not been identified. Once the suspicious activity was detected, the CPR administration revoked the company’s access. Danish police and other authorities are currently investigating the details of how the breach transpired and which records were accessed. They also reviewed data protected under Denmark’s name and address protection scheme, discovering that protected names and addresses did not form part of the exposed information.
Data authority investigates automated CPR search activities
Datatilsynet, Denmark’s data protection authority, was notified of the breach on Oct. 4. The agency reported that a very high volume of automated searches had targeted the CPR system. The notification indicated that these searches aimed to verify valid CPR numbers. Datatilsynet is now examining how unauthorized parties gained access and what personal data was retrieved. Its review also includes assessing who bears responsibility under Danish data protection regulations for processing the compromised information.
Research, Education and Digitalisation Minister Christina Egelund characterized the incident as highly serious and informed parliament’s Business and Digital Affairs Committee. She mandated a comprehensive security review of the CPR system and its access controls. The government has initiated steps to mitigate the risk of similar breaches in the future. Authorities are continuing to trace the sequence of events and assess the safeguards employed by private organizations granted approved access to CPR data.
Public advised to remain vigilant against potential scams
Danish officials have called on residents to be cautious of fraudulent calls, emails, and messages that might exploit exposed personal data. Authorities cautioned against sharing passwords or confidential information, especially if a caller appears to already know the individual’s name, address, or CPR number. The government directed citizens to official digital security guidance and Denmark’s cyber hotline. Authorities have not confirmed whether the accessed information has been used for fraud, identity theft, or other criminal activities beyond the initial unauthorized searches.
Investigations into the breach remain ongoing, focusing on how the attackers gained access, which records were compromised, and the security measures surrounding private use of the CPR system. The identity of the company involved and the specific method of misuse have not been publicly disclosed. Authorities are also yet to identify those responsible for the searches. As of Oct. 7, the CPR administration, police, and regulators were conducting separate reviews of the incident, while Denmark was evaluating security protocols around its national population register.