Denmark Central Population Register (CPR) data breach

Denmark disclosed that unauthorized parties used a private company's access to the national Central Population Register to extract names, addresses and CPR numbers of about 8.8 million living and deceased people.

Incident ID

CP-2026-006

Disclosure date

05 OCT 2026

Detection date

02 OCT 2026

Affected countries

Denmark

Plotted location

Copenhagen, Denmark (Affected government register administration)

Threat classification

Level 3 — ELEVATED

Classification rationale

Exposure of national identity-register data covering essentially the entire population.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Misuse of a small private company's legitimate access to the CPR system (reportedly a weak password) to run millions of lookups over about ten days in September

Sectors

Government

Critical infrastructure

Yes

Organizations affected

CPR administration (Danish Ministry of Digitalisation), Pays ApS (vendor whose access was abused)

Operational consequences

Records of about 8.8 million people were exposed; the minister ordered a security review, the company's access was blocked and police opened an investigation. Nearly one million Danes registered credit warnings within days.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded

SOURCE REFERENCES

1. [1] Denmark population registry data breach affects 8.8 million peopleBleepingComputer · bleepingcomputer.com
2. [2] Data breach at Denmark's population register exposes 8.8 million peopleHelp Net Security · helpnetsecurity.com · 06 OCT 2026
3. [3] Nearly one million Danes add credit warnings after breach of 8.8 million CPR recordsThe Copenhagen Post · cphpost.dk · 08 OCT 2026

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.