Breaches and incidentsBriefChecked against a primary source
Denmark Central Population Register (CPR): 8.8 million people’s names, addresses and CPR numbers accessed
The Danish Ministry of Higher Education and Science (responsible for CPR.
- Disclosed
What happened
- The Danish Ministry of Higher Education and Science (responsible for CPR; Minister Christina Egelund) disclosed on 5 Oct 2026 that irregular searches in September exposed names, addresses and CPR numbers of about 8.8 million living, deceased and emigrated people, roughly 80% of the register. People with name and address protection were not exposed in that respect. CPR administration learned of it on 2 Oct and notified Datatilsynet on 4 Oct.
- Root cause: the attackers misused a private Danish company’s legitimate CPR access and stayed within the data types private companies may retrieve. How the credentials were obtained has not been officially disclosed (a Politiken report about weak passwords is unconfirmed).
- Attacker: unknown; the ministry said it is “not possible to say anything about who is behind it”.
- Response: the company’s access was cut, police investigating, Datatilsynet opened a case, and a security review of the CPR system was ordered.
Sources
- https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/
- https://www.helpnetsecurity.com/2026/10/06/denmark-central-population-register-cpr-data-breach
- https://www.bleepingcomputer.com/news/security/denmark-population-registry-data-breach-affects-88-million-people/
- https://thehackernews.com/2026/10/denmark-says-attackers-accessed-cpr.html
- https://cphpost.dk/2026-10-05/life-in-denmark/cpr-data-breach-exposes-personal-details-of-8-8-million-people-in-denmark/
- https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.