COPENHAGEN, DENMARK / RankWire.AI / – A significant security breach involving Denmark’s Central Person Register (CPR) has prompted an investigation by Danish officials, revealing that personal data of approximately 8.8 million individuals was compromised. The breach occurred when unauthorized actors exploited a private Danish firm’s legitimate access to the CPR system. In response, the CPR administration has revoked the company’s access as authorities analyze the incident’s circumstances.
The CPR administration detected suspicious activity on the evening of Oct. 2, following unusual search activity recorded during September. Over the weekend, authorities reviewed the data and verified the extent of unauthorized access. The Central Person Register contains roughly 11 million records, including details of current residents, individuals who have relocated abroad, and deceased persons. Officials clarified that the searches remained within the scope of data that private companies are permitted to access via authorized CPR services.
The identity of the individual or group responsible for the activity has yet to be determined. Danish officials have also not disclosed the private company whose authorized access was exploited. The CPR administration reported the breach to Datatilsynet, Denmark’s data protection authority, and police are collaborating with other relevant agencies. The government stated that its review found no exposure of names and addresses protected under Denmark’s name and address protection scheme.
Regulator investigates automated searches in CPR system
Datatilsynet announced it received a report regarding the incident from the CPR register on Oct. 4. The authority indicated that a large volume of automated searches targeting the CPR system was involved. The notification specified these searches aimed to identify valid CPR numbers. Datatilsynet is now examining the details of the breach, how access was gained, and who might be responsible for processing the personal information involved. The regulator assured that further updates will be provided once there is enough information to do so.
Research, Education and Digitalisation Minister Christina Egelund characterized the incident as extremely serious and briefed Denmark’s Business and Digital Affairs Committee in parliament. She also mandated a comprehensive security review of the CPR system. The government has initiated measures to prevent similar breaches in the future, while the CPR administration continues its efforts to reconstruct the sequence of events. Authorities noted that the investigation is still in the early stages, and technical assessments may lead to more precise details.
Public advised to be vigilant against fraud
Officials in Denmark urged residents to remain cautious of potential scams involving fraudulent calls, emails, or messages that may leverage exposed personal information. They emphasized that individuals should never disclose passwords or confidential details simply because someone claims to know their name, address, or CPR number. The government directed the public to official digital security guidelines and Denmark’s cyber hotline. This warning followed confirmation that the unauthorized activity involved data belonging to millions of registered people in the national population registry.
Authorities continue their investigation into the method of access, affected records, and the safeguards surrounding private-sector use of the CPR system. Datatilsynet is separately reviewing the data protection implications of the breach. The CPR administration has suspended the company’s access and implemented security measures, while officials carry out an expanded review of the registry. As of Oct. 7, the authorities had not publicly identified the perpetrators, disclosed the name of the involved company, or confirmed the specific technique used to misuse its authorized access.