Denmark has confirmed a major data breach involving its Central Population Register, known as CPR, after unauthorized parties accessed personal records belonging to about 8.8 million people. The exposed information includes names, addresses, and CPR numbers, according to an official statement published on October 5, 2026.
The figure exceeds Denmark’s population of roughly six million because the register also holds records of people who have moved abroad and those who have died. Officials said the CPR system currently contains approximately 11 million registered people, meaning the incident affected a large share of its records.
…
The attackers misused a private Danish company’s lawful access to search the CPR system during September. Authorities have not described how the unauthorized parties obtained or used that access, leaving the initial entry method unknown.
The confirmed route is important: this was misuse of an approved company connection, not a publicly confirmed software flaw in the register. The ministry has not disclosed the company’s name, linked the incident to a known threat group, or identified a specific vulnerability.
…
Research, Education and Digitalization Minister Christina Egelund described the incident as deeply serious. She informed Parliament’s Business and Digitalization Committee and requested a thorough security review of CPR. Officials said preventive measures had already started, without detailing their technical scope.
…
Names, addresses, and national identification numbers can make fraudulent messages and calls appear convincing. Cybersecurity News’ coverage of the Pentagon data breach similarly highlights the risks when personal records include identity numbers, while its phishing prevention guidance explains common warning signs.
…
For those who are not familiar with the Danish citizen register: Basically it’s an ancient system made way before computers were a thing and it’s just not been updated to modern standards because politicians never prioritize things before they blow up in their face.
The crux of the issue: In Denmark, your personal ID is not just an ID, it is also an access token. So you need to keep your ID number secret, otherwise others can use it to look up your personal information. Like, imagine your username was also your password, that’s how dumb this system is. Add to this the fact that certain private companies get priveliged access to the citizen register for reasons and anyone with a few braincells could predict this happening 20 years ago.
In Sweden this info is public. Same ID format, but just using your name I can find out everything about you.
Haha I work in German government IT and have a colleague who likes to point to Denmark as an example for how good things could be here. I’ll show him this next time he needs to put down the rose glasses.
That said, it’s the same in Germany, only that citizen data is kept with municipalities, so we have ca. 11.000 different such shitty systems built decades ago instead of one - which makes it less attractive and damaging to compromise any given one, I guess.
At least, however, we don’t have a citizen ID such as the one you describe, that could be used to identify people uniquely.
With NOOTS Germany will move toward a less decentralized service with municipalities being able to share data between them more easily. I hope though that BSI pressures for it to be secure by modern standards.
we don’t have a citizen ID
OK, so you forgot the Sozialversicherungsnummer and the Steuer-ID?
They are not really the same though. These are domain specific identities. Sure, the tax office has your tax ID. But your municipality, the state health authorities or the retirement insurance will never ask you your tax ID, don’t have access to it and are not allowed to process it. It’s not a citizen ID that can be used to link different data sets and it’s not saved in the Melderegister.
At least, however, we don’t have a citizen ID such as the one you describe, that could be used to identify people uniquely.
Oh don’t get me wrong, there is nothing wrong with a citizen ID. Actually a citizen ID is very useful. It should just only be an ID and shouldn’t give any access.
Depends how much you trust the state. After the Nazi period, the German state is actually not allowed to keep persistent identifiers on people. You can only identify any. given citizen through a domain ID that may not be shared or used beyond a specific domain (e.g tax ID) or a combination of changeable attributes (address, name, etc.).
In practice this can be annoying, but it’s also a useful precaution to prevent the government form easily pooling and linking information on citizens across domains and levels of state.
People need to understand how f*king bad this is.
We know, it happens in America nearly every day, and those are just the ones we hear about. I just assume bad guys already have every bit of data on me already.
Having used the system some time ago, I’m not too worried. It only shows the name and latest address. Basically like the white pages but with a soc.sec.ID instead of the phone number.
It lacks info on a lot of people, because some people aren’t too good at reporting when they move, and some are hidden for legal reasons.
The most dangerous thing would be if the data is sold to stalkers, because it does have more addresses than the white pages.
The soc.sec.no. includes birthday and gender, so it can also be used for targeting scams.
Anyway, it’s not like this data wasn’t already available in one way or another. The breach just made it easier for whoever did it.
Ah, so the equivalent of the Swedish ratsit/eniro/mrkoll etc…
We dont have to worry about a similar thing happening in sweden cause our system is fucked up and everybody already has access to every registered(not even just citizens) persons name, address, phone number, etc.
In a country of 6 million people, getting 8.8 million CPR numbers is impressive.
The registry includes every single person has lived in Denmark at any point since 1962 or something, that’s the actual reason for the larger numbers
This is why we need age verification in the EU, so hackers don’t need to attack individual countries.
But at least the children will feel safe.
Except that underage people (aka children) will be flagged in the data set and thus be easy to search.
Sounds like they went in through the front door. Great security there. At least one of Denmark’s neighbours provides similar access to companies.
I wonder how long they can keep the hacked company’s name undisclosed
