COPENHAGEN, DENMARK / RankWire.AI / – The Central Person Register (CPR) in Denmark is under review following reports of unauthorized access to personal data, impacting approximately 8.8 million individuals. The breach involved details such as names, addresses, CPR identification numbers, and other registered information. Officials explained that the intruders used credentials associated with a private Danish firm that had legitimate authorization to access the national population database. The company involved has not been publicly identified.
On the evening of October 2, the CPR system detected irregular activity, which had been occurring through a series of searches in September. Over the subsequent weekend, authorities analyzed the incident to determine the extent of the breach. The CPR database contains roughly 11 million entries, including current residents, people who have emigrated, and deceased individuals. Officials confirmed that the searches fell within categories of information accessible via authorized CPR services.
The individuals responsible for the unauthorized access have yet to be identified. After noticing the suspicious activity, the CPR administration promptly revoked the company’s access. Danish law enforcement and related agencies are investigating the circumstances of the breach and which specific records were accessed. An additional review was conducted on data protected under Denmark’s name and address protection scheme, with officials confirming that protected names and addresses did not comprise part of the compromised data.
Data authority evaluates automated searches within CPR system
Datatilsynet, Denmark’s data protection authority, was notified of the incident on October 4. The regulator reported that an extremely high volume of automated queries had been directed at the CPR database. The notification indicated these searches aimed to verify the validity of CPR numbers. Datatilsynet is currently investigating how unauthorized parties accessed the system and what personal data was retrieved, as well as assessing responsibility for processing the compromised information under Danish data protection laws.
Research, Education and Digitalisation Minister Christina Egelund characterized the incident as highly serious, informing the parliament’s Business and Digital Affairs Committee. She has ordered a comprehensive security review of the CPR system and its access protocols. Measures are also being implemented to mitigate the risk of similar breaches in the future. Officials are continuing to analyze the timeline of events and scrutinize the safeguards used by private organizations with authorized access to CPR data.
Government issues warning about potential fraud schemes
Authorities in Denmark have issued alerts to the public, warning of possible fraud attempts involving calls, emails, and messages that could contain exposed personal information. Citizens are advised not to share passwords or confidential data, especially if contacted by someone claiming to know their name, address, or CPR number. The government has directed residents to official digital security resources and Denmark’s cyber hotline. There is no confirmation yet that the accessed data has been exploited for fraud, identity theft, or other illegal acts beyond the unauthorized searches.
Investigations remain ongoing into how the breach occurred, what records were affected, and the security measures surrounding private access to the CPR system. The identity of the company involved and the specific methods used to misuse authorized access have not been publicly disclosed. Authorities continue to review the incident separately, with Denmark assessing overall security protocols for its national population registry as of October 7.