Denmark's CPR Breach: 14 Million Lookups in Ten Days
Someone ran 14 million lookups in ten days through a small firm’s legal access to Denmark’s Central Person Register (CPR). The breach only surfaced when officials came to bill the firm on a Friday evening.
Background
October 6, 2026 - 2:24 pm
Nyhavn in Copenhagen, Denmark Credit: Erfan Amiri on Unsplash
Unknown users have pulled names, addresses and ID numbers on approximately 8.8 million people from the CPR. They abused a small Danish company’s legal access to the register. Denmark's digitalisation ministry announced the breach on Monday. The CPR administration has terminated the company’s access, and the police are investigating.
Denmark has about 6 million residents, according to Statistics Denmark. The register holds roughly 11 million records, including individuals who have passed away or moved abroad. However, the breach did not affect those who opted for name and address protection.
"This is a deeply serious incident," said Christina Egelund, the minister for science, higher education and digital affairs.
Discovery of the Breach
The lookups occurred over ten days in September. The company’s account made well over 14 million CPR lookup attempts, with 8.8 million returning a record, officials revealed at a press briefing on Tuesday (TV 2 reported). Companies are charged per lookup, and the CPR breach came to light when the administration billed the firm.
"I can confirm that it is during invoicing on Friday evening that a very, very large amount is billed, which alerts you that there has been very large activity during September," explained Mikkel Leihardt, a department head at the ministry.
The ministry identified the irregular activity on October 2nd in the evening. They established the full extent over the weekend. Officers from the National Unit for Special Crime visited the company on Saturday evening to collect evidence. Henriette Erbs, a unit head, noted that no individuals have been identified or charged at this time, and they are reaching out to police in other countries.
Access and Security
Private companies can access CPR data under Section 38 of the Danish Civil Registration System Act if they have a legitimate interest and identify individuals specifically. The ministry has not named the involved company.
Minister Egelund ordered a security review of the CPR system with no set deadline. She told TV2 it was too early to determine whether people would receive new CPR numbers. She also stated that the breach did not impact systems utilizing MitID, Denmark’s national digital login, such as those in healthcare.
Laila Reenberg, heading Styrelsen for Samfundssikkerhed (Denmark's agency for civil security), advised companies and authorities to stop accepting a CPR number as proof of identity alone. Pharmacies, which currently accept the number independently, must find alternative methods.
"You cannot use it to authorize things, to buy something, or to get sensitive personal information," Reenberg stressed.
Digital investigator Jan Kaastrup characterized the system as "broken" in an interview with TV2:
"We live in a digitalized society, and therefore we should have much better identification systems."
Egelund urged Danes to be cautious of calls, emails, and links, warning that criminals could exploit the data for phishing attempts. In August, ShinyHunters accessed 1.6 million records from RingCentral with a single phone call. That same month, France's tax agency suffered a breach exposing data on 678,000 individuals, while hackers targeted Liechtenstein’s beneficial owners register.