VULNpocalypse
HighBreach / campaignOngoing

Denmark CPR breach: 8.8 million names, addresses and CPR numbers pulled through one company’s login

Attackers used one firm’s CPR access to pull names, addresses and CPR numbers of 8.8 million people in Sep 2026. A CPR number no longer proves identity.

Published
Updated
Exploitation
Yes. Automated lookups through a private company’s CPR access between 10 and 20 September 2026

What happened

On 5 October 2026 Denmark’s Ministry of Research, Education and Digitalisation said unauthorised parties had obtained data on about 8.8 million people from the Central Person Register (CPR), which holds about 11 million records, including living, emigrated and deceased people (ministry press release, Danish). That is roughly 80% of the register (Help Net Security).

What was taken: names, addresses and CPR numbers “and more” (the ministry’s list is not exhaustive). Names and addresses of people registered with name and address protection were not included (ministry).

How it happened. The attackers did not break into the register itself. They misused a private Danish company’s legal right to search CPR, and stayed within the data types private companies may normally receive (ministry). Under section 38 of the CPR Act, companies with a legitimate interest can query CPR about people they have already identified individually (ministry). About 1,039 companies, including financial firms, telecoms, law firms, trade unions and insurers, hold that access (Ritzau via Sjaellandske).

Timeline:

  • 10 September: the attacker’s access began. The CPR office’s report to Datatilsynet says the attacker had access for 21 days and 17 hours in total but did not use it throughout; preliminary findings put the end of the compromise at 20 September (TV 2 Kosmopol).
  • 10 to 20 September: TV 2, citing documents, reported about 14 million automated searches (The Register).
  • 2 October (evening): the CPR administration learned of the activity. A ministry director said staff spotted an invoice showing unusually high activity from the company (The Register).
  • 4 October: Datatilsynet notified (Help Net Security).
  • 5 October: public disclosure. The company’s access was cut and police opened an investigation (ministry).
  • 9 October: Pays ApS, a firm on Funen, confirmed through its managing director that its access had been exploited. The government has not named it (The Register).
  • 9 and 10 October: the CPR administration wrote to all 1,039 companies with CPR access tightening the rules. Minister Christina Egelund told two parliamentary committees that security around the system “has not been good enough” (Ritzau via Sjaellandske).

How the company’s account was taken: press reports, not officially confirmed. Ritzau reports the attacker got in with a leaked password belonging to a former employee. Politiken found at least three Pays profiles, one an administrator, using the password “123456”, and an anonymous person told Politiken they were behind the attack and did not intend to sell or leak the data (Ritzau via Sjaellandske; The Register). The government did not answer questions about the passwords. The National Special Crime Unit has not said who is behind the access (TV 2 Kosmopol).

Am I affected?

  • Individuals: if you have a CPR number and are not under name and address protection, assume you are in the set. The ministry has not announced a lookup service or individual notifications (ministry).
  • Organisations operating in Denmark: you are affected if any process accepts a CPR number, or CPR number plus name and address, as identity proof. Typical places: phone support identity checks, password or PIN resets, address changes, parcel or prescription pick-up, and account recovery forms. Laila Reenberg, director of the Danish Agency for Societal Security (Samsik), put it plainly: having someone’s CPR number no longer means you have identified a specific citizen (TV 2 Kosmopol).
  • The 1,039 companies with CPR access: you received the CPR administration’s letter and must meet its requirements (below).

What to do now

  1. Individuals: never give passwords, MitID codes or other confidential details by phone or email, “even if the recipient apparently knows your name, address and CPR number” (Help Net Security). Guidance is on sikkerdigital.dk, and the Cyberhotline is +45 33 37 00 37 (ministry).
  2. Organisations: remove CPR number, name and address as a passing answer in identity checks. Replace them with MitID authentication, a callback to a number already on file, or a one-time code to a registered device.
  3. Companies with CPR access: the letter of 9 October requires you to appoint a security officer, continuously review which employees can reach CPR data, and monitor your monthly number of CPR transactions to catch misuse (Ritzau via Sjaellandske). Given how this access was reportedly taken, also: disable CPR accounts of anyone who has left, give each user a unique strong password and multi-factor login where your integration supports it, and set an alert well below the volume a 14-million-search run would produce. Here the first sign was an invoice.
  4. If you integrate with CPR through an API client: check your own logs for 10 to 20 September 2026 for query volumes you cannot explain. Pays was one of many authorised clients; the same kind of credential exists at every one of them.

Sources