Hackers broke into Denmark’s national population register. They pulled records on about 8.8 million people, Danish authorities said on October 5, 2026. That is more than Denmark’s entire population of roughly 6 million. The Denmark CPR data breach exposed records going back years, including people who have died or moved abroad. Names, home addresses and national ID numbers were all exposed.
What the Denmark CPR Data Breach Exposed
The Central Person Register, known as the CPR, is Denmark’s core identity database. It assigns every resident a personal ID number. That number gets used across healthcare, banking, taxes and government services. Cybernews’ reporting on the incident says attackers used access credentials that belonged to a private Danish company to search the register. The register itself holds roughly 11 million records. That explains why a breach of 8.8 million entries can outnumber the country’s living population.
People already enrolled in Denmark’s name and address protection scheme were not affected, officials said. Everyone else had their name, home address and CPR number exposed. Whoever misused that stolen access now holds that information.
Why a National ID Breach Hits Differently Than a Typical Hack
Most consumer data breaches expose usernames, emails or card numbers. Those can usually be changed after a breach. A CPR number cannot be changed. It follows a Danish resident for life. It links medical records, tax filings, pension accounts and government correspondence together. That permanence is exactly why Denmark’s Minister of Research, Education and Digitalization, Christina Egelund, called the incident “a deeply serious incident.” She urged citizens to stay alert “now and in the future,” according to ITPro’s account of the government’s response.
Denmark’s MitID two-factor login system should stop attackers from directly impersonating someone using a CPR number alone. Still, officials warned residents to expect a wave of phishing attempts. Fake texts, calls and emails may come from people posing as banks or government agencies. Those scammers already know their target’s name, address and ID number. That makes the scam far more convincing than an ordinary phishing attempt would be.
What Security Researchers Say Went Wrong at the CPR
The breach traces back to legitimate access, not a software flaw. A private company had standing permission to search the CPR system. Attackers appear to have hijacked that access rather than breaking in directly. Cybersecurity researchers quoted by ITPro flagged two separate problems with that setup. One researcher pointed to the lag between when the intrusion began in September and when staff first noticed irregular activity. That activity surfaced on the night of Friday, October 2. The researcher called that detection gap a common weakness whenever a breach arrives through a third party. Another researcher warned that centralized national databases carry outsized risk whenever outside partners get direct search access. That expert recommended stricter limits on what partners can view, paired with monitoring for unusual search patterns.
Denmark is not the first European country to face a breach of this scale. Government identity systems have become frequent targets. A single successful intrusion can expose data on nearly an entire population at once. European data protection law requires member states to report major breaches quickly. It also requires them to notify affected individuals when the risk is high. Danish officials have not yet said whether every affected resident will get an individual notice, or only a general public warning.
Denmark has reported the incident to its national data protection authority. Police are now investigating alongside other agencies. The government has not named the company whose access was exploited. It has not identified any suspects either.
How Denmark Is Responding to the CPR Data Breach Now
Officials revoked the abused access credentials. They say they have added new protections to the CPR system since. A broader security review is underway across government agencies that rely on the register. Denmark’s response mirrors a pattern now familiar across the tech industry. Companies and governments alike are tightening data access, even as they rethink how they screen for vulnerabilities in increasingly complex systems.
The incident also lands amid wider scrutiny of how technology platforms handle sensitive data and automated systems. That theme surfaced days earlier at a city council hearing on AI governance in New York. It surfaced again in an unrelated trade secrets dispute between Apple and OpenAI set for mid-October. None of those cases involve the Danish breach directly. But they reflect a broader year in which lawmakers and regulators on both sides of the Atlantic have pushed harder on how data gets stored, shared and protected.
For now, Danish residents have been told to avoid sharing passwords or one-time login codes with anyone who contacts them unexpectedly. That holds true even if the caller already knows personal details. Security firms recommend verifying any unexpected request through an official phone number or website, rather than a number the caller provides.
Denmark Data Breach: What People Are Asking
How many people were affected by the Denmark CPR data breach?
About 8.8 million records were accessed, out of roughly 11 million total entries in the register. Those entries include deceased people and former residents.
What information was exposed?
Names, home addresses and CPR numbers, Denmark’s national ID number, were exposed. People enrolled in the country’s address protection program were excluded from the exposure.
How did hackers get into the system?
They used access credentials belonging to a private Danish company. That company had legitimate permission to search the register, so this was not a technical break-in.
When was the breach discovered?
Irregular activity was first spotted on the night of Friday, October 2, 2026. The government confirmed the scope of the breach and went public on October 5.
Can someone use a stolen CPR number to steal my identity?
Denmark’s MitID two-factor system limits that risk. Still, officials warned residents to watch for phishing calls, texts and emails from people who already know their personal details.
Has anyone been identified as responsible for the breach?
No. Officials had not named a suspect as of their statements. They had not confirmed whether the breach originated from a criminal group or another source.
