A Danish company had legitimate access to search the CPR, Denmark’s Central Personal Register, which holds records on approximately 11 million registered persons. During September 2026, unauthorised individuals misused that access to enter the system.
The CPR administration detected irregular behaviour on Friday evening in late September 2026. Over the weekend, it confirmed that names, addresses and CPR numbers belonging to approximately 8.8 million registered persons had been accessed.
The affected records include living and deceased people, as well as citizens who have moved abroad. Names and addresses belonging to people registered for name and address protection were excluded from the unauthorised access.
The administration stopped the company’s access to the system and reported the incident to Datatilsynet, the Danish Data Protection Authority. Police are investigating alongside other relevant authorities.
The breach was made public on 5 October 2026 in a press statement from the Research, Education and Digitalization Ministry.
Christina Egelund, the Research, Education and Digitalization Minister, described the breach as serious and told the Folketing’s Business and Digitalization Committee about it. “It is a deeply serious incident, which is why I have also informed the Folketing's Business and Digitalization Committee about it.”
She said the authorities were still establishing the scope of what occurred. “Together with all relevant authorities we are in the process of mapping the full extent of the incident.”
The CPR holds further personal details, including marital status, birth registration information, family relationships, church affiliation and information about legal guardianship. The confirmed unauthorised access concerned names, addresses and CPR numbers.
Egelund said measures had already been introduced in relation to the register. “We have already initiated measures in relation to CPR that should prevent similar incidents.”
She has also called for a thorough security review of the CPR system and urged citizens to remain vigilant and consult sikkerdigital.dk.
Citizens have been reminded never to disclose passwords or other confidential information in telephone calls, emails or similar contacts, even where the person contacting them appears to know their name, address and CPR number.
Comments (0)