Denmark says 8.8M affected by breach of national population register

· Cybersecurity · Denmark

Denmark's digitalization ministry said on October 5 that unauthorized parties accessed the names, addresses and personal identification numbers of about 8.8 million people, living and dead, in the national CPR population register. Attackers abused a private Danish company's lawful access to look up records in the system. The figure covers roughly the whole Danish population, since the register includes deceased citizens as well. The country's central person register underpins identity checks across banking, healthcare and government services, so the exposure of identity numbers raises the risk of impersonation and fraud at national scale. Danish authorities have not named the company involved, and the breach has become the largest data incident of its kind reported in Denmark.

Why it matters：A breach reaching nearly an entire national population through a company's legitimate lookup access shows how third-party data permissions have become a systemic risk to government registers worldwide; expect tighter access controls and audits for any commercial users of state identity systems.

Key points

  • Names, addresses and personal identification numbers were exposed, according to the digitalization ministry.
  • Access was obtained through a private Danish company's lawful right to look up CPR records, not a direct hack of the register.
  • The 8.8 million figure covers both living and deceased registered citizens.

Sources (original reporting)

More stories from this day