The Danish CPR Breach — 8.8 Million Records Through a Company's Lawful Lookup Access

At 07:00 on Monday 5 October 2026, Denmark's Ministry of Research, Education and Digitalisation announced that unauthorised parties had obtained names, addresses, CPR numbers and other details of about 8.8 million people from the Central Person Register (CPR). The minister, Christina Egelund, said she had briefed the Folketing's Business and Digitalisation Committee. Nobody broke into the register: the lookups ran through one private company's lawful access, millions of times over.

Why 8.8 Million

The figure is larger than Denmark's population, and the ministry explained why. The CPR holds about 11 million registered people: besides current residents, it keeps those who have died and those who have moved abroad. The 8.8 million covered the living, the emigrated and the dead.

Not a Break-In

The register was not hacked in the usual sense. Under section 38 of the CPR Act, private companies with a legitimate interest may have register data delivered on a defined group of people they have already identified individually — customers or members, for example — and over 1,000 companies hold such access, among them banks, telecoms operators, law firms, trade unions and insurers. According to the ministry, the unauthorised parties used one private Danish company's lawful access to search the CPR, staying within the categories of data that private companies are entitled to receive.

The Danish Data Protection Agency (Datatilsynet), describing the notification it received from the CPR on Sunday 4 October, said a very large number of automated lookups had been made against the CPR system with the aim of identifying valid CPR numbers.

How the company's own systems were compromised has not been officially explained. The company has not been named by the authorities; DR reported that it was a small software firm on Funen. According to TV 2, the CPR office told Datatilsynet that the number of lookups far exceeded the company's customer base and that the company had indicated it had not made them itself.

Found Through an Invoice

Companies pay per lookup. Mikkel Leihardt, a department head at the ministry, told the briefing that it was the invoicing run on Friday evening, billing a very, very large amount, that alerted officials. The timeline was filled in later by TV 2, which obtained the CPR office's notification to Datatilsynet through a freedom-of-information request.

Response

The CPR administration stopped the company's access, reported the case to Datatilsynet, and the police opened an investigation; at the 6 October briefing police said they were in contact with police in other countries. The ministry's release said the investigation was at an early stage and that it was not possible to say who was behind it. Datatilsynet said it was examining what had happened, how it could happen and who was responsible for the processing of personal data involved, and that it could not yet assess the case. An anonymous individual later claimed to the newspaper Politiken to be responsible; the authorities have not confirmed that account.

A Number Everyone Knows

Since 1968 the CPR has recorded everyone who lives or has lived in Denmark, and its number is what public and private services use to tell one resident from another. The breach exposed a tension in that arrangement. The data that leaked was largely what the register already releases to over a thousand companies; what was missing was a check on whether one small company's account, querying millions of people who could not all be its customers, was behaving like a customer at all. Unlike the Canvas breach earlier in the year, there was no extortion note and no defaced login page.