Cybersecurity
Denmark registry breach exposed 8.8 million records
Denmark’s Central Population Register said a September incident exposed personal data on about 8.8 million registered people, and authorities said police were investigating how the access was abused.
- The Central Population Register said personal information on about 8.8 million registered individuals had been exposed.
- The Danish Data Protection Agency said the attack involved brute-forcing valid CPR numbers and then pulling data from the matching records.
- Authorities said the private company’s access to the registry system had been blocked and police had opened an investigation.
- Christina Egelund said she had informed Parliament’s Business and Digitalization Committee and that extra security measures had been added.
The Central Population Register said the breach affected people living in Denmark, people who had moved abroad and deceased people. It said the system held data for 11 million registered citizens, so the incident covered about 80% of that total.
According to the CPR, attackers used a private Danish company’s legitimate access to the registry system to obtain names, addresses, CPR numbers and other details. The Danish Data Protection Agency said the method involved brute-forcing to identify valid CPR numbers before extracting the related records.
The security incident took place in September 2026. CPR administration said it became aware of it on 2 October and worked out the scale over the weekend.
Egelund said she had told Parliament’s Business and Digitalization Committee about the case. She said officials were working with relevant authorities to establish the full extent of the incident, and the agency said a cyber hotline and online guidance were available for potentially affected people.
Named in this story
People
- Christina Egelund
- said she had informed Parliament’s Business and Digitalization Committee
Governments and agencies
- Denmark's Central Population Register (CPR)
- said its registry had exposed personal information
- Danish Data Protection Agency
- said brute-forcing had been used to enumerate valid CPR numbers
- Parliament’s Business and Digitalization Committee
- was informed about the incident
Products and systems
- sikkerdigital.dk
- was listed as an online source of help and guidance
How the source tells it
The piece was a formal incident report with restrained official urgency, driven by government warnings and direct references to the breach as serious.
- urgency official warnings and advice to stay on high alert
- seriousness a minister described the incident as extremely serious