Denmark reports major data breach affecting around 8.8 million residents

Denmark's Central Civil Registration System (CPR) has suffered a significant security breach in which unauthorized third parties gained access to the personal data of a large share of the country's population. According to initial findings, the incident affected approximately 8.8 million registered residents.

How the breach occurred

The breach stemmed from misuse of legitimate access: a Danish company that had lawful access to the registry's search system either abused that access itself or allowed unauthorized parties to exploit it. This allowed the perpetrators to reach a broad set of personal information, including residents' names, home addresses, and national identification numbers (CPR numbers).

Investigation underway

The responsible authority has launched a review to determine the full extent and consequences of the breach. Based on preliminary findings, the scope of the unauthorized access is still being assessed, and complete details about its impact are not yet available.

The CPR registry holds core information on every person registered in Denmark, including identification numbers that are widely used across both public and private sector services. A breach of this scale therefore raises concerns about potential identity theft and other forms of fraud affecting those whose data was exposed.

Authorities have not yet disclosed which specific company was involved in the incident, nor the exact mechanism behind the unauthorized access. The investigation into the circumstances of the breach continues.