Hackers steal records of 8.8 million people from Denmark's CPR registry

Hackers stole personal records of about 8.8 million people from Denmark's Central Population Register, the national civil registry holding names, addresses and unique CPR identification numbers used for taxes and government services. The attack occurred in September 2026 and was discovered on October 2, 2026, with the size of the impact determined over the following weekend.techcrunch.com

The breach matters because it touches roughly 80% of the 11 million records the register holds, far exceeding Denmark's current population of about 6 million. Records include people living abroad and deceased individuals, and the data goes back decades. The incident is thought to be the biggest data breach in the country's history.bleepingcomputer.com

How the registry access was abused

The Danish Data Protection Agency said the attack involved some form of brute-forcing, a technique of systematically guessing values, to enumerate valid CPR numbers, then extract the related data from each entry. A CPR announcement said threat actors misused a private Danish company's legitimate access to the registry system to obtain the information.

The Danish government said the unauthorised access was obtained by abusing a Danish company's lawful access to search for information in the CPR system. Some companies in Denmark hold CPR access to verify people's information with the government. The private company's access to the registry has now been blocked, and police have launched an investigation that is underway.

Taken data includes names, addresses, dates of birth, marital status and unique CPR identification numbers, the identifier Danish residents use for paying taxes and accessing other services. The register holds records for about 11 million people, against a Danish population of about 6 million, with some data going back decades.

What data was taken

Minister for Research, Education and Digitalization Christina Egelund called the breach an extremely serious incident and said she informed Parliament's Business and Digitalization Committee. She said authorities are working to establish the full extent of the incident, and that additional security measures have been implemented to prevent similar incidents on the CPR system.

Egelund urged citizens to stay on high alert for unsolicited communications. A dedicated cyber hotline has been set up for potentially affected individuals, with help and guidance available online at sikkerdigital.dk. The announcement warned people never to disclose passwords or confidential information in response to calls or emails, even if the sender appears to know their name, address and CPR number.

The Danish government would not say who is behind the breach. The incident follows similar cyberattacks on government national identity databases, including a 2016 breach affecting millions of Turkish citizens and several exposures of national ID cards and data spilled from India's national Aadhaar database of citizens. The breach also comes as European data regulators press companies over privacy failures. Italy's Data Protection Authority fined IQVIA €7 million, about $7.8 million, over health-data anonymisation practices affecting roughly one million patients, and ordered compliance within 120 days. Police are investigating the Danish breach, and the government has not identified the attackers. Further detail on how the private company's access was compromised has not been provided; the agency had not responded to a request for information as of publication on October 5, 2026.bleepingcomputer.com