Denmark's CPR population register breach exposes data on 8.8 million people

On 5 October 2026, Denmark — through its government's digitalisation authority — disclosed a major security incident affecting the Central Person Register (CPR), the national database that assigns every resident a unique 10-digit identification number used across public services, banking and healthcare. Unidentified actors misused a private Danish company's legitimate access to the register to extract records on roughly 8.8 million people, far more than the company's authorisation under Danish data rules should have allowed.

The exposed information includes names, addresses and CPR numbers, along with other data held in the register. Because the CPR holds records on living residents, people who have emigrated and the deceased, the 8.8 million figure exceeds Denmark's resident population of about six million. People who had registered for name and address protection were not exposed in the leak.

Detection and response

Irregular behaviour in the CPR system was first detected on the evening of Friday 2 October 2026, with the unauthorised access traced back to an unspecified point in September. The company involved was blocked from the system while police opened an investigation, and authorities said it was too early to determine who was behind the breach. Digitalisation Minister Christina Egelund called it "a deeply serious incident," ordered a comprehensive security review of the CPR system, and urged residents to watch for suspicious communications.

Why it matters

The breach is one of the largest ever to hit Denmark and underlines a recurring systemic risk: a well-defended government register can still be drained wholesale through a trusted third party's credentials. CPR numbers are deeply embedded in Danish identity verification, so their mass exposure heightens the risk of identity fraud and targeted phishing for nearly the entire population, even though the leaked fields stop short of financial or health data.