What happened
On October 5, 2026, Denmark's government disclosed one of the largest data exposures in the country's history. Unauthorized parties obtained the names, addresses and CPR numbers (Denmark's personal ID number) of about 8.8 million people in the Central Person Register (CPR). The figure includes living, deceased and emigrated people; the register holds about 11 million entries.
The key detail: nobody broke into the system in the classic sense. The attackers abused a small Danish company's lawful access to look up CPR data.
How it was done
- Under Danish law (section 38 of the CPR Act), companies with a legitimate interest can retrieve data on people they have already identified individually. A CPR number alone is enough for that.
- Over about 10 days in September, that company's account made more than 14 million lookup attempts, testing CPR numbers in bulk. About 8.8 million returned a record.
- Each lookup on its own was within the permissions. The problem was volume: over a million a day, far beyond any plausible business need.
- People with name and address protection did not have those details exposed.
How it was found: through the bill
Companies pay for every lookup. Officials told a press briefing on the 6th that the anomaly surfaced on the evening of Friday, October 2, when the CPR administration went to invoice the firm and saw a huge amount. In other words, security monitoring didn't catch the abuse; billing did.
Response
- The company's access was revoked; it has not been named publicly.
- The case was reported to Datatilsynet (the data protection authority), and police are investigating with authorities in other countries. As of the 6th, no one had been identified or charged.
- Minister Christina Egelund ordered a full security review of the CPR. It's too early to say whether people will get new CPR numbers.
- Systems using MitID (the national digital login), such as healthcare, were not affected.
- The civil protection agency said a CPR number can no longer be relied on alone to identify a person. Public agencies added extra questions to phone support.
The risk now
With a name, address and ID number in hand, scammers can sound very convincing on calls and emails. The government warned: never give passwords or confidential information to anyone who calls or writes, even if they already know your name, address and CPR number.
Lessons for any company
- Legitimate access is also an attack surface. Partner accounts and paid APIs need volume limits and alerts.
- Monitor usage anomalies, not just intrusions. A million lookups a day should trip an alarm on day one.
- Don't use public identifiers as proof of identity. An ID number is not a password; that goes for Social Security numbers, Brazil's CPF and Japan's My Number.
- Review third-party data-access contracts: purpose, expected volume and audit.
Sources
- Denmark's Ministry of Research, Education and Digitalisation (Oct 5, 2026): https://fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/
- The Hacker News: https://thehackernews.com/2026/10/denmark-says-attackers-accessed-cpr.html
- The Next Web: https://thenextweb.com/news/denmark-cpr-breach-8-8-million-records
- CSIS Security Group: https://www.csis.com/csis-tech-blog/the-hub/cpr-breach-denmark
Want to review how partners and APIs access your company's data? KGA IT offers a free consultation: kga-it.com.