Danish Data Protection Agency (Organization): news timeline & CVEs

Denmark's ID register spills more people's details than the country has residents

Abuse of a Danish firm's CPR access exposed personal data on about 8.8 million people.

Denmark's Central Population Register said an unauthorized party abused a small private company's legitimate access and exposed names, addresses, and CPR numbers for about 8.8 million people. The register holds roughly 11 million records, including people who died or moved abroad, which is why the total exceeds Denmark's population of about 6 million; name-and-address-protected entries were not exposed. Officials blocked the company's access, notified the Danish Data Protection Agency, and police are investigating whether new CPR numbers must be issued.

The Register · Securityupdated Oct 10, 20:42 UTC · 10h agofirst Oct 6, 11:46 UTC · 4d agoData breach in the wild 16 sources2· 1 read

8.8 Million Impacted by Data Breach at Denmark’s Central Person Register

Hackers stole names, addresses, and national ID numbers of about 8.8 million people from Denmark's Central Person Register.

Denmark's Central Person Register is notifying about 8.8 million people that names, addresses, and CPR numbers were stolen. Hackers used a Danish company's lawful access to the national civil register, which holds records on about 11 million people; abnormal September activity was confirmed over the weekend. Individuals who opted into name and address protection were not affected. CPR cut off the company's access, notified the Danish Data Protection Agency, and opened a police investigation; the actor was not named.

SecurityWeekupdated Oct 10, 20:42 UTC · 10h agofirst Oct 6, 09:38 UTC · 4d agoData breach in the wild 16 sources1

Data breach at Denmark’s population register exposes 8.8 million people

Denmark's Central Population Register breach exposed names, addresses, and CPR numbers of 8.8 million people via misused company access.

Attackers obtained names, addresses and CPR numbers of 8.8 million people—roughly 80% of Denmark's 11-million-record national register—by misusing a private Danish company's legitimate search access during September 2026. CPR administration learned of irregular activity on October 2 and notified the Danish Data Protection Agency on October 4, with police investigating and the company's access cut off. Minister Christina Egelund informed Parliament and ordered a thorough security review. People registered with name and address protection were not exposed, and officials warn the data could enable convincing fraud attempts.

Help Net Securityupdated Oct 10, 20:42 UTC · 10h agofirst Oct 6, 09:05 UTC · 4d agoData breach 16 sources1

Denmark population registry data breach affects 8.8 million people

Denmark's population registry says attackers exposed personal data on about 8.8 million people.

Denmark's Central Population Register warned that personal data on about 8.8 million registered people was exposed, including residents, people who moved abroad, and deceased individuals. Attackers misused a private Danish company's legitimate access and brute-forced valid CPR numbers to obtain names, addresses, identification numbers, and related records. The register holds data on about 11 million people, so roughly 80 percent were affected. The incident occurred in September 2026, was identified on October 2, the company's access has been blocked, and police are investigating.

BleepingComputerupdated Oct 10, 20:42 UTC · 10h agofirst Oct 5, 15:21 UTC · 5d agoData breach in the wild 16 sources1· 1 read

Data breach at Denmark’s national population register exposes 8.8 million people

Unauthorized access to Denmark’s population register exposed names, addresses, and ID numbers for about 8.8 million people.

Denmark is investigating unauthorized access to its Central Person Register that exposed names, addresses, and CPR numbers for about 8.8 million people. The perpetrators used an unnamed domestic company’s legitimate access; officials detected irregular activity on Friday and said the breach occurred during September. The Data Protection Agency, notified Sunday, described a very large number of automated searches aimed at identifying valid CPR numbers, which are lifelong identifiers used for healthcare, banking, and government services. Research and digitalisation minister Christina Egelund ordered a broad security review and extended the national digital-security hotline.

The Recordupdated Oct 10, 20:42 UTC · 10h agofirst Oct 5, 12:00 UTC · 5d agoData breach 16 sources3· 2 reads

Danish Data Protection Agency

Timeline5 articles

Appears with

Denmark's ID register spills more people's details than the country has residents

8.8 Million Impacted by Data Breach at Denmark’s Central Person Register

Data breach at Denmark’s population register exposes 8.8 million people

Denmark population registry data breach affects 8.8 million people

Data breach at Denmark’s national population register exposes 8.8 million people