Denmark breach exposes personal data of 8.8 million people in population register

Denmark only has 6 million people, but the database includes information from both living and deceased persons. The CPR administration says unauthorized individuals misused a Danish company’s legitimate access to search the CPR system, gaining access to names, addresses, CPR numbers and other information on about 8.8 million people. Irregular activity detected on October 2 ultimately led the administration to determine that unauthorized searches had taken place during September.

Acknowledged the “deeply serious incident,” Digitalization Minister Christina Egelund has ordered a comprehensive security review of the CPR system , which assigns every resident a unique 10-digit number to be used when dealing with government agencies, banks and healthcare providers. Launched for all government services more than 50 years ago, and linked in 2023 to the MitID digital identity, CPR is considered a “cornerstone” of Denmark’s digital public sector. According to Danish news agency Ritzau, the register includes information on church membership, details of legal incapacitation and restrictions on legal capacity.

Per a report from the Copenhagen Post, the government has not yet decided whether people affected by the breach will need to have new CPR numbers issued to them. A hotline has been established to provide support, as Denmark’s data protection authority and National Special Crime Unit investigate.