One Company's Access, 8.8 Million Records: Denmark's Population Register Breach in Q&A

Denmark has disclosed a breach of its national population register that touches roughly four in five of the people recorded in it. The way it happened, through a business that was allowed to search the system, makes it a useful case study for any organization that shares access with partners. We have organized the essentials as questions and answers.

What system was breached?

The Central Population Register, known as the CPR, is Denmark’s national civil registry. It holds residents’ names, addresses, dates of birth, marital status and their unique CPR identification numbers.

How many people are affected?

About 8.8 million. The register currently covers 11 million people, so roughly 80% of its entries were affected. The total includes people living in Denmark, people who have moved abroad and people who have died.

How did the attackers get in?

According to the CPR announcement, they misused the legitimate access a private Danish company had to the registry. Through it they obtained names, addresses, CPR numbers and other details. A separate notice from the Danish Data Protection Agency says the attackers used a form of brute-forcing to discover valid CPR numbers and then pulled the data attached to each one.

When did this happen, and when was it found?

The activity took place in September 2026. The CPR administration learned of it on October 2 and worked out the scale over the following weekend.

What has been done so far?

The company’s access to the registry has been cut off.
Police have opened an investigation.
Minister for Research, Education and Digitalization Christina Egelund called it an extremely serious incident, informed Parliament’s Business and Digitalization Committee, and said extra security measures have been put in place on the CPR system.
A dedicated cyber hotline has been set up, with guidance online at sikkerdigital.dk.

What are people being told to do?

Stay alert for unexpected calls and emails, and never hand over passwords or other confidential details, even when the person contacting you seems to already know your name, address and CPR number.

Is anything still unknown?

Yes. BleepingComputer asked how the private company was compromised and had not received an answer at publication time.

For the original report, see Bill Toulas’ article on the CPR breach at BleepingComputer.

What this means for your company

Partner access is your attack surface. Any vendor, reseller or contractor account that can query your systems needs the same scrutiny as your own staff accounts.
Rate limits and alerts matter. Enumeration and bulk extraction produce unusual volumes of lookups. Set thresholds on APIs and portals, and get an alert when an account suddenly behaves like a scraper.
Expect convincing follow-up scams. When personal data leaks at this scale, fraudsters use it to sound legitimate. Remind staff that knowing someone’s details proves nothing.
Review who can see what. Grant third parties only the fields and record counts they truly need, and revisit those permissions on a schedule.

Need help controlling and monitoring the access your partners and vendors have to your data? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.