Denmark's population register breach exposes identifying data on 8.8 million people
Denmark's population register exposed names, addresses and CPR identification numbers for about 8.8 million people through misused company access. Access was blocked; investigations continue. Treat callers who know these details with caution.
Never give passwords or other confidential information to an unsolicited caller or email sender, even if they know your name, address and CPR number. For official guidance, visit sikkerdigital.dk or call Denmark's Cyberhotline on +45 33 37 00 37. There is no device update for this breach.
What’s happening
Unauthorised parties misused a Danish company's legitimate access to Denmark's Central Population Register (CPR), obtaining names, addresses, national identification numbers and other information for approximately 8.8 million registered people. Those affected include residents, people living abroad and deceased people. The ministry says protected names and addresses were excluded. The activity occurred in September and was discovered on 2 October. Access was blocked, police began investigating and the ministry ordered a security review. Earlier reporting identified Pays ApS; on 23 October, Datatilsynet announced a formal investigation involving the CPR administration and Charity Guard ApS, without establishing their precise responsibilities. Its questions cover access controls and detection of unusual searches. As of 3 November, the sources reviewed contain no final regulatory decision, announced charges or verified deletion of the exposed data. Whether the information has subsequently been used for fraud is unknown. This is a data breach, with no device update for affected families.
- What
- Breach
- Affects
- Denmark's Central Population Register (CPR)
- Fixed in
- Nothing to patch
- Since
- 5 Oct 2026
Timeline
- Update
The regulator's inquiry quoted Charity Guard's breach notification as estimating about 15 million lookups, compared with the 14 million reported earlier by The Register. The letter requested answers within three weeks.
- Update
Datatilsynet announced a formal investigation and sent questions to the CPR administration and Charity Guard ApS about how the searches happened and what safeguards existed. It had not yet determined whether data-protection rules were followed.
- Update
The Register reported that Pays ApS's managing director had confirmed on 9 October that its access was misused. A person claiming responsibility told Politiken they did not intend to sell or publish the data.
- Made publicNothing to patch
The ministry publicly disclosed the breach and said the company's registry access had been blocked. Police were investigating, additional safeguards had been introduced and a security review was being launched.
- Update
Datatilsynet received the CPR administration's breach notification. The notification described large numbers of automated searches intended to identify valid CPR numbers.
- Update
The CPR administration discovered unusual activity from September. Over the following weekend, it established that approximately 8.8 million registered people's information had been accessed.
- Update
According to documents obtained by TV 2 and reported by The Register, unauthorised access began on 10 September. About 14 million automated searches were made between then and 20 September.
Sources
- Omfattende uautoriseret adgang til borgeres CPR-oplysningerDanish Ministry of Research, Education and Digitalisation · 5 Oct 2026
- Datatilsynet er opmærksom på sag om opslag i CPRDatatilsynet · 5 Oct 2026
- Datatilsynet indleder formel undersøgelse af CPR-sagenDatatilsynet · 23 Oct 2026
- Inquiry to CPR-administrationen concerning a personal data breachDatatilsynet · 23 Oct 2026
- Inquiry to Charity Guard ApS concerning a personal data breachDatatilsynet · 23 Oct 2026
- Denmark population registry data breach affects 8.8 million peopleBleepingComputer · 5 Oct 2026
- '123456' password linked to Denmark data breach affecting 8.8M peopleThe Register · 13 Oct 2026