Denmark CPR Registry Breach: About 8.8 Million Records Exposed
A trusted company’s access became the route to names, addresses, and national ID numbers.
On October 5, 2026, Denmark's Ministry of Digital Affairs announced unauthorized access to around 8.8 million records in the country's national population registry, the CPR register.
Here is what Danish authorities have disclosed, and the practical steps to take.
What happened
Unauthorized people compromised a Danish company that was legally authorized to access the CPR register, then misused that access to obtain registry data.
Police opened an investigation, and the incident was reported to the Danish Data Protection Authority.
Data involved
The exposed categories were names, addresses, and CPR numbers, Denmark's national identification numbers. Reporting put the scale at around 8.8 million registry records.
No source cited here establishes how the exposed data was later used.
What to do
- Treat unexpected contact as unverified. Personal details in a message do not prove the sender is legitimate. Verify notices through an official channel you find independently. (See Spot the phish before you touch the bait and Would you catch the phish?.)
- Watch your accounts. Review financial and account activity, and turn on alerts where available.
- Consider a credit freeze or fraud alert where available. Use the official process for the country where the relevant accounts are held.
- Use unique passwords and stronger sign-in protection. See One unique password for every door and The login prompt you didn’t request.
- Report suspected fraud. Use the official fraud-reporting service for your country.
The lesson worth keeping
The incident shows how a trusted third party's access can become the route into a larger system. Organizations should review vendor permissions, monitor authorized access, and revoke access that is no longer needed.
Sources: WE News English ↗ · Sweden Herald TT wire ↗ · FTC: What To Do After a Data Breach ↗