COPENHAGEN, DENMARK / RankWire.AI / – Authorities in Denmark are scrutinizing a breach involving unauthorized access to personal information stored within the country’s Central Person Register, known as CPR. The incident impacted records associated with approximately 8.8 million individuals. The compromised data included names, addresses, CPR identification numbers, and other registered details. Officials stated that the intruders exploited credentials linked to a private Danish company authorized to search the national population registry. The company’s identity has not been disclosed by authorities.
The CPR administration observed irregular activity on October 2 evening, following a series of searches conducted throughout September. Over the subsequent weekend, officials analyzed the activity, establishing the scope of the breach. The CPR database holds around 11 million entries in total, encompassing current residents, individuals who have relocated abroad, and deceased persons. Authorities confirmed that the searches remained within categories of information accessible through authorized CPR services.
No suspects have been identified in connection with these unauthorized searches. Upon discovering the suspicious activity, the CPR administration revoked the company’s access. Danish law enforcement and other relevant authorities are investigating how the breach occurred and which records were accessed. Officials also checked whether any information protected under Denmark’s name and address protection scheme was involved. They concluded that protected data under that program was not part of the exposed information.
Data watchdog investigates automated searches of CPR data
Datatilsynet, Denmark’s data protection authority, received notification of the breach on October 4. The regulator indicated that a significant number of automated queries had been carried out against the CPR system. The notification states these searches aimed to verify the validity of CPR numbers. Datatilsynet is now examining how unauthorized individuals gained access and what personal details were retrieved. Its review also encompasses the responsibilities related to processing the compromised data under Danish data protection regulations.
Research, Education and Digitalisation Minister Christina Egelund characterized the event as deeply serious, informing parliament’s Business and Digital Affairs Committee. She has mandated a comprehensive security assessment of the CPR system and its access controls. The government has initiated measures to mitigate the risk of similar incidents recurring. Authorities are still mapping the sequence of events and evaluating the security procedures private organizations use to access CPR data with approved authorization.
Public advised to be vigilant against potential scams
Officials in Denmark have urged residents to be alert for scam calls, emails, and messages that might contain exposed personal data. They warned the public against sharing passwords or confidential information, especially if a caller claims to already know their name, address, or CPR number. The government has directed citizens to official digital security resources and Denmark’s cyber hotline. While authorities have not confirmed that the accessed information was exploited for fraud, identity theft, or other criminal activities beyond the unauthorized searches, vigilance remains critical.
Investigation teams continue to analyze the breach route, the records affected, and the security measures surrounding private access to the CPR system. The authorities have not revealed the identity of the company involved nor the specific method used to misuse its authorized access. Additionally, the public has not been informed about the individuals responsible for the searches. As of October 7, the CPR administration, police, and regulators are conducting independent investigations into the incident, while Denmark is assessing the security of its national population registry.