{"id":"denmark-population-register-breach-oct-2026","category":"breach","status":"live","title":"Denmark's population register breach exposes identifying data on 8.8 million people","tldr":"Denmark's population register exposed names, addresses and CPR identification numbers for about 8.8 million people through misused company access. Access was blocked; investigations continue. Treat callers who know these details with caution.","summary":"Unauthorised parties misused a Danish company's legitimate access to Denmark's Central Population Register (CPR), obtaining names, addresses, national identification numbers and other information for approximately 8.8 million registered people. Those affected include residents, people living abroad and deceased people. The ministry says protected names and addresses were excluded. The activity occurred in September and was discovered on 2 October. Access was blocked, police began investigating and the ministry ordered a security review. Earlier reporting identified Pays ApS; on 23 October, Datatilsynet announced a formal investigation involving the CPR administration and Charity Guard ApS, without establishing their precise responsibilities. Its questions cover access controls and detection of unusual searches. As of 3 November, the sources reviewed contain no final regulatory decision, announced charges or verified deletion of the exposed data. Whether the information has subsequently been used for fraud is unknown. This is a data breach, with no device update for affected families.","action":"Never give passwords or other confidential information to an unsolicited caller or email sender, even if they know your name, address and CPR number. For official guidance, visit sikkerdigital.dk or call Denmark's Cyberhotline on +45 33 37 00 37. There is no device update for this breach.","product":"Denmark's Central Population Register (CPR)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["denmark","cpr","government","data-breach","personal-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Omfattende uautoriseret adgang til borgeres CPR-oplysninger","url":"https://fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/","by":"Danish Ministry of Research, Education and Digitalisation","date":"2026-10-05"},{"kind":"advisory","title":"Datatilsynet er opmærksom på sag om opslag i CPR","url":"https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-er-opmaerksom-paa-sag-om-opslag-i-cpr","by":"Datatilsynet","date":"2026-10-05"},{"kind":"advisory","title":"Datatilsynet indleder formel undersøgelse af CPR-sagen","url":"https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-indleder-formel-undersoegelse-af-cpr-sagen","by":"Datatilsynet","date":"2026-10-23"},{"kind":"advisory","title":"Inquiry to CPR-administrationen concerning a personal data breach","url":"https://www.datatilsynet.dk/Media/639283613184368164/hoering-cpr-administrationen.pdf","by":"Datatilsynet","date":"2026-10-23"},{"kind":"advisory","title":"Inquiry to Charity Guard ApS concerning a personal data breach","url":"https://www.datatilsynet.dk/Media/639283613127948153/hoering-charity-guard.pdf","by":"Datatilsynet","date":"2026-10-23"},{"kind":"news","title":"Denmark population registry data breach affects 8.8 million people","url":"https://www.bleepingcomputer.com/news/security/denmark-population-registry-data-breach-affects-88-million-people/","by":"BleepingComputer","date":"2026-10-05"},{"kind":"news","title":"'123456' password linked to Denmark data breach affecting 8.8M people","url":"https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726","by":"The Register","date":"2026-10-13"}],"started":"2026-10-05","closed":null,"created":"2026-11-03T20:18:01.690Z","updated":"2026-11-03T20:18:01.690Z","cve_notes":[],"timeline":[{"at":"2026-10-23","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The regulator's inquiry quoted Charity Guard's breach notification as estimating about 15 million lookups, compared with the 14 million reported earlier by The Register. The letter requested answers within three weeks.","url":"https://www.datatilsynet.dk/Media/639283613127948153/hoering-charity-guard.pdf","by":"Datatilsynet","patch":null},{"at":"2026-10-23","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Datatilsynet announced a formal investigation and sent questions to the CPR administration and Charity Guard ApS about how the searches happened and what safeguards existed. It had not yet determined whether data-protection rules were followed.","url":"https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-indleder-formel-undersoegelse-af-cpr-sagen","by":"Datatilsynet","patch":null},{"at":"2026-10-13","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The Register reported that Pays ApS's managing director had confirmed on 9 October that its access was misused. A person claiming responsibility told Politiken they did not intend to sell or publish the data.","url":"https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726","by":"The Register","patch":null},{"at":"2026-10-05","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"The ministry publicly disclosed the breach and said the company's registry access had been blocked. Police were investigating, additional safeguards had been introduced and a security review was being launched.","url":"https://fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/","by":"Danish Ministry of Research, Education and Digitalisation","patch":"na"},{"at":"2026-10-04","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Datatilsynet received the CPR administration's breach notification. The notification described large numbers of automated searches intended to identify valid CPR numbers.","url":"https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-er-opmaerksom-paa-sag-om-opslag-i-cpr","by":"Datatilsynet","patch":null},{"at":"2026-10-02","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"The CPR administration discovered unusual activity from September. Over the following weekend, it established that approximately 8.8 million registered people's information had been accessed.","url":"https://fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/","by":"Danish Ministry of Research, Education and Digitalisation","patch":null},{"at":"2026-09-10","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"According to documents obtained by TV 2 and reported by The Register, unauthorised access began on 10 September. About 14 million automated searches were made between then and 20 September.","url":"https://www.theregister.com/security/2026/10/13/123456-password-linked-to-denmark-data-breach-affecting-88m-people/5302726","by":"The Register","patch":null}],"url":"https://hard.fyi/live/denmark-population-register-breach-oct-2026/","json":"https://hard.fyi/api/live?id=denmark-population-register-breach-oct-2026"}