Denmark says unauthorized access exposed about 8.8 million CPR records, including deceased registrants
Denmark’s CPR authority said on Oct. 5 that an actor abused a legitimate lookup channel available to a private company during September 2026 and accessed data tied to about 8.8 million registered individuals, including names, addresses, and CPR numbers. The figure exceeds Denmark’s population of roughly 6.03 million because the central population register also retains records for deceased people and residents who have moved abroad. Authorities said the incident was an “unauthorized access,” not a confirmed hack, and did not say the data had been offered for sale. The authority said the suspicious activity was only detected on the evening of Oct. 2, with the scope established over the weekend. The CPR system holds about 11 million registrants in total, putting the exposed set at roughly 80% of the database. Records covered by name and address protection were not included, based on the current review. The lookup route used in the case is supposed to require private companies with a legitimate interest to identify individuals in advance under Section 38 of the CPR Act and comply with GDPR, but officials have not explained how one channel mapped to 8.8 million people. Denmark has shut the company’s access route, reported the case to Datatilsynet, and said police and other authorities are investigating.
