Denmark’s digitalisation ministry said on Monday, October 5, that unauthorized parties had collected names, addresses and CPR numbers for about 8.8 million people from the country’s Central Person Register. The Denmark CPR leak did not start with a break-in at a government server: the ministry says someone misused a private Danish company’s lawful right to search the register.
Where it stands: At a press briefing the day after the announcement, police said they had identified no one and charged no one, according to The Next Web. The company has not been named, its access has been blocked, the case sits with the Danish Data Protection Agency (Datatilsynet), and the minister has ordered a full security review of the CPR system.
What the Denmark CPR leak exposed
The CPR is the national civil register, and almost everything in Danish life hangs off it. Help Net Security describes the number this way: “the 10-digit CPR number it assigns to each person is used for everything from taxes and healthcare to banking.”
The ministry’s own press release says the unauthorized access covered names, addresses and CPR numbers, among other details, for roughly 8.8 million registered people. That is far more than the country’s population. The Next Web notes that “Denmark has about 6 million residents, according to Statistics Denmark,” while the register itself holds about 11 million entries because it keeps people who have emigrated and people who have died. BleepingComputer summarises who is in scope: “people who live in the country, individuals who have moved abroad, and also deceased people.”
One group was spared. According to the ministry’s review so far, as reported by The Copenhagen Post, “the names and addresses of people who have registered for name and address protection were not exposed.”
How one company’s search access became the way in
Danish law lets private firms with a legitimate interest look up CPR records about people they have already identified. The ministry says the intruders “abused a Danish company’s lawful ability to search the CPR system,” staying inside the kinds of data such firms are normally allowed to see.
The scale only surfaced because every lookup costs money. Per The Next Web, “Companies pay for every lookup, and the CPR breach came to light when the CPR administration billed the firm.” Officials told the follow-up briefing that the account had run “well over 14 million CPR lookup attempts, and 8.8 million returned a record.”
The data protection agency’s own notice adds a detail about method. BleepingComputer read it as saying the attack “involved some form of brute-forcing to enumerate valid CPR numbers, and then extract the related data from each entry.” In plain terms: guess numbers in bulk, keep the ones that match a real person.
What remains unknown is just as important. The ministry has not said how the attackers came to control the company’s access, whether the data has been sold or used, or who is responsible. Help Net Security reports the ministry saying it is “not possible to say anything about who is behind it” so far, and the press release describes the investigation as being at an early stage.
Timeline of the CPR register incident
| When | What happened |
|---|---|
| September | Bulk lookups run through the company’s account |
| Friday, October 2 (evening) | CPR administration spots irregular activity |
| Weekend of October 3-4 | Scale established; Datatilsynet notified on Sunday |
| Monday, October 5 | Ministry discloses the incident; company access blocked |
| Tuesday, October 6 | Briefing gives lookup totals; no suspects identified |
Minister Christina Egelund called it “a deeply serious incident” and said she had briefed the parliament’s Business and Digitalisation Committee.
Why a leaked CPR number is a problem, and where it stops
A CPR number is a lifelong identifier, so it cannot be rotated like a password. Asked whether people would be issued new ones, Egelund told TV 2 it was too early to say.
The practical risk is convincing fraud. A caller who already knows your full name, address and CPR number sounds official. That is why the ministry’s release warns people not to hand over passwords or confidential details, a rule that, in BleepingComputer’s translation, “also applies even if the recipient appears to know your name, address, and CPR number.”
There are limits on what the number alone unlocks. Egelund said the breach did not reach systems that use MitID, the national digital login. Laila Reenberg, head of Denmark’s civil security agency, told companies and authorities to stop accepting a bare CPR number as proof of identity. “You cannot use it to authorise things, to buy something or to get sensitive personal information,” she said, according to The Next Web.
A separate breach the same week: DTU
Days before the ministry spoke, the Technical University of Denmark disclosed its own incident. Attackers took over DTU user profiles and used them to reach DTUBasen, its identity and access management system, which held records going back to 2003. DTU says “up to 200,000 current and former users may have been affected,” drawn from about 40,000 active and 160,000 former users.
For active users, DTU lists CPR numbers, full names, home addresses and profile pictures, plus next-of-kin contact details where people entered them. Former users’ addresses and next-of-kin data are deleted after six months, but their CPR numbers and names stay. DTU is notifying people it holds CPR numbers for through e-Boks. No source links the DTU attack to the register incident; they are two different intrusions that happen to involve the same kind of number.
If you were also caught up in a university breach, our guide to identity protection after a university breach covers the extra steps.
What to do if you have a Danish CPR number
You do not need to wait for a letter to act. The register incident has no individual notification process described in the official statements, so treat your number as exposed if you have ever been registered in Denmark, including if you have since moved abroad.
- Distrust messages that know too much. A call, text or email that quotes your CPR number proves nothing about who sent it. Hang up and call the organisation back on a number you looked up yourself.
- Guard MitID. Never read out a MitID code and never approve a login request you did not start yourself. DTU gives the same advice to its users: do not approve unexpected login or authentication requests.
- Consider a credit alert. DTU suggests people “consider registering a credit alert against your CPR number at Borger.dk,” which makes it harder for someone to take out credit in your name.
- Change reused passwords. If a password you used anywhere near your CPR details is reused elsewhere, change it on every site that shares it.
- Protected-address holders: the register leak did not include your name and address, but if you are in the DTU data, DTU says to be especially careful about unwanted contact.
- Watch for slow-burn fraud. Fraudsters often sit on leaked data for months. Our explainer on what identity monitoring alerts can and cannot tell you helps you judge paid monitoring offers.
The ministry points people to sikkerdigital.dk and to the Cyberhotline for digital security on +45 33 37 00 37, which it said would run extended hours, 8:00 to 24:00, in the days after the announcement. Other breaches disclosed this autumn are collected in our October 2026 data breach roundup.
Frequently Asked Questions
Was my CPR number exposed in the Denmark breach?
If you have ever been registered in Denmark, it may have been. The ministry put the figure at about 8.8 million registered people, a group that covers current residents, people who have moved abroad and people who have died. The only group it has said was spared is people registered with name and address protection, whose names and addresses were not exposed.
Did hackers break into the Danish government CPR system?
Not in the usual sense. The ministry says the data was obtained by misusing the lawful search access of a private Danish company, which the CPR administration has since cut off. How the attackers came to control that access has not been explained.
Will Danes get new CPR numbers after the leak?
No decision has been made. The minister told TV 2 it was too early to say, and a security review of the CPR system has been ordered.
Can someone log in to MitID with my CPR number?
The minister said the incident did not touch systems that rely on MitID. A CPR number on its own should not unlock anything, and Denmark’s civil security agency has told companies and authorities to stop treating it as proof of identity. Never share MitID codes or approve a login you did not start.
Is the DTU breach part of the same incident?
No source links them. DTU disclosed its own breach of its DTUBasen identity system, covering up to 200,000 current and former users, several days before the ministry announced the CPR incident.
Sources
- Omfattende uautoriseret adgang til borgeres CPR-oplysninger (press release, in Danish) — Danish Ministry of Research, Education and Digitalisation (via Ritzau), October 5, 2026
- CPR data breach exposes personal details of 8.8 million people in Denmark — The Copenhagen Post, October 5, 2026
- Denmark population registry data breach affects 8.8 million people — BleepingComputer (Bill Toulas), October 5, 2026
- Data breach at Denmark’s population register exposes 8.8 million people — Help Net Security (Sinisa Markovic), October 6, 2026
- Denmark’s CPR breach: 14 million lookups in ten days, found through a bill — The Next Web (Ana Maria Constantin), October 2026 (after the October 6 briefing)
- Cyberattack on DTU: Notification of a personal data breach — Technical University of Denmark (DTU), October 2, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.