COPENHAGEN, DENMARK / RankWire.AI / – In Denmark, authorities are expanding their probe into a significant security breach affecting the country’s Central Person Register. The breach involved unauthorized access to personal data of approximately 8.8 million individuals. The compromised information included names, addresses, CPR numbers, and related records. Officials have stated that the intruders exploited a private Danish company’s legitimate access to search the CPR system. As a result, the CPR administration has suspended the company’s access while investigations determine how the breach occurred.
The CPR administration detected suspicious activity on the evening of Oct. 2, following unusual search activity during September. Over the weekend, authorities examined the incident and confirmed the extent of the unauthorized data access. Denmark’s Central Person Register holds roughly 11 million records, covering current residents, those who have moved abroad, and deceased individuals. Officials clarified that the searches were limited to information categories accessible legally by private companies through authorized CPR services.
The identity of those responsible for the activity remains unknown. Danish officials have not disclosed the private company whose lawful access was exploited by the attackers. The CPR administration reported the breach to Datatilsynet, Denmark’s data protection authority, and law enforcement agencies are investigating alongside other relevant bodies. The government emphasized that its review found no exposure of names and addresses protected under Denmark’s name and address protection scheme.
Regulator investigates automated searches in CPR system
Datatilsynet announced it received the incident report from the CPR register on Oct. 4. The authority indicated that the case involved a vast number of automated searches targeting the CPR system, aimed at verifying valid CPR numbers, according to the notification. The regulator is now examining the sequence of events, how the unauthorized access was made possible, and who is responsible for processing the personal data involved. Further information will be released once there is sufficient clarity to do so.
Research, Education and Digitalisation Minister Christina Egelund described the incident as highly serious and briefed the parliament’s Business and Digital Affairs Committee. She also ordered a comprehensive security review of the CPR system. The government has begun implementing measures to prevent similar breaches in the future, while the CPR administration continues to map out the sequence of events. Authorities stated that the investigation is still in its early stages and that ongoing technical assessments may clarify further details.
Public advised to remain vigilant against scam attempts
Officials in Denmark urged citizens to stay alert for potential scams involving fraudulent calls, emails, and messages that may leverage exposed personal information. They advised people never to share passwords or other sensitive data simply because someone knows their name, address, or CPR number. The government recommended consulting official digital security resources and Denmark’s cyber hotline. This warning followed confirmation that the unauthorized activity involved data belonging to millions of individuals registered in the national population system.
Authorities are continuing their efforts to evaluate the breach’s access methods, affected records, and the safeguards around private-sector use of the CPR database. Additionally, Datatilsynet is independently reviewing the data protection concerns raised by this incident. The CPR administration has suspended the company’s access and initiated security measures, while authorities conduct a broader review of the registry. As of Oct. 7, no publicly available information has revealed the attackers’ identities, disclosed the private company involved, or confirmed the specific method used to misuse the authorized access.