A data breach affecting Denmark’s Central Population Register (CPR) has exposed the personal information of approximately 8.8 million people.
The breach exposed names, addresses, dates of birth, marital statuses, and unique CPR identification numbers. CPR ID is a 10-digit number used to access various public services, such as healthcare, taxation, banking, and more. Exposing the CPR number puts the victims at risk of identity theft and fraud.
Consequently, Danish Digitalization Minister Christina Egelund advised victims to remain vigilant for suspicious communication from potential fraudsters.
8.8 million people impacted by Denmark’s Central Population Registry data breach
CPR says the data breach affected individuals, including current residents, people who had relocated to other countries, and deceased persons. However, people who registered with name and address protection were unaffected.
While Denmark has a population of 6 million people, 11 million are registered in the country’s central population database. According to CPR, the data breach affected 8.8 million people, or roughly 80% of the registered population.
CPR also disclosed that the attackers exploited a third-party company’s access to breach the central population registry system, then used brute force to guess CPR numbers, which they used to extract people’s full details.
“It appears from the notification that a very large number of automated lookups have been made against the CPR system in order to identify valid CPR numbers,” the registry stated.
The security incident occurred in September 2026, but CPR only learned of the data breach on October 2 after detecting suspicious activity related to unauthorized searches. The registry responded by blocking the breached company’s access to its systems to prevent further compromise, and implementing additional security measures to prevent future incidents.
CPR also notified the Parliament’s Business and Digitalization Committee, and on October 4, the registry alerted Denmark’s Data Protection Agency, Datatilsynet. Similarly, an investigation into the full scope of the incident involving security experts is ongoing, and the registry has set up a hotline to assist victims.
Meanwhile, the country’s Digitalization Minister has described the data breach as a serious incident and ordered a security review of the affected information system.
So far, CPR has not disclosed the identity of the threat actor or their motive, and there is no indication that the attacker has demanded a ransom. However, personal identification details are highly sought in dark web hacking forums for various cybercrimes, including identity theft, fraud, and targeted phishing.
“The breach of Denmark’s Central Population Register (CPR) highlights a critical third-party risk: legitimate, standing access,” said Michael Centrella, Head of Public Policy at SecurityScorecard. “This compromise occurred because unauthorized person(s) reportedly misused a private Danish company’s legitimate access to the CPR registry system to gain unauthorized access to 8.8 million records.”
“Vendor risk management cannot rely on static, annual reviews. To catch this type of abuse early, security teams must continuously monitor third-party access patterns and dynamically tie permissions to real-time risk posture,” added Centrella.
Central population registries targeted worldwide
Across the world, population registries have experienced data breaches, exposing the personal information of millions of citizens.
In 2023, Indonesia’s Directorate General of Population and Civil Registration experienced a data breach exposing the personal information of over 337 million people. In 2026, the country’s citizen database was listed on a dark web hacking forum.
In the same year, a data breach at Bangladesh’s Birth and Death Registration Information System (BDRIS) exposed Birth and Death Registration details of over 50 million people. The country’s ICT minister blamed the breach on a lack of minimum security controls despite prior warnings.
The leaked personal details, including names, birth dates, and National Identification (NID) numbers, became easily searchable online, exposing victims to irreparable damage. Unlike account information, such as usernames and passwords, which can be changed when exposed, government-issued IDs cannot be altered. However, there was no indication that hackers had accessed the leaked personal details at the time of the announcement.
In the same year, Bangladesh’s intelligence body, the National Telecommunication Monitoring Center, leaked personal details, including names, phone numbers, passport details, professions, blood groups, fingerprint photos, parents’ names, call durations, and vehicle registrations.
Other central registration database leaks include the 2016 Turkish citizen database leak that exposed the personal information of 50 million people.
