Denmark Registry Breach Hits 8.8 Million People

Denmark's Central Population Register has disclosed a data breach exposing the personal information of approximately 8.8 million registered individuals — roughly 80% of everyone in the national civil registry — after attackers misused a private company's legitimate access to the system.

Key facts

The Central Population Register is Denmark's national civil registry. It holds personal information on residents including names, addresses, dates of birth, marital status, and the unique CPR identification number every Dane uses across government services, banking and healthcare.

According to the CPR's announcement, attackers obtained names, addresses, CPR numbers and other information relating to registered members by misusing a private company's legitimate access to the registry system.

The Danish Data Protection Agency says the attack involved some form of brute-forcing to enumerate valid CPR numbers, then extract the related data from each entry. Brute-forcing means systematically trying values until valid ones are found — here, guessing at CPR numbers to discover which exist.

Legitimately. Many private organizations in Denmark — banks, insurers, utilities — hold authorized access to the registry to verify identities. That access was not stolen in the sense of a broken lock; it was abused.

How the company itself was compromised has not been disclosed. BleepingComputer contacted the agency for more detail and had not received a response at publication.

This is the defining feature of the incident: the registry's own defenses were not what failed. A third party's credentials became the door.

The private company's access has been blocked, police have opened an investigation, and the CPR says additional security measures have been implemented.

Minister for Research, Education and Digitalization Christina Egelund called it an extremely serious incident and said she had informed Parliament's Business and Digitalization Committee. A dedicated cyber hotline has been set up for affected individuals, with guidance available at sikkerdigital.dk.

The official advice is to stay on high alert for unsolicited communications, and never to disclose passwords or other confidential information in response to telephone calls, emails or similar contact.

The crucial line in the government's warning: this applies even if the caller appears to know your name, address and CPR number.

That is the practical risk from a breach like this one. The stolen data does not itself empty a bank account. What it does is make the next scam call convincing, because the caller can recite details only a legitimate institution should know.

Three things carry over anywhere.

Vendor access is your attack surface. Every third party with authorized access to your systems is a potential route in, and most organizations cannot list theirs from memory.

Systematic enumeration is detectable. An account making huge volumes of sequential lookups is visible in logs — the question is whether anyone is watching, and whether rate limits exist on legitimate access.

Identifier-based identity verification breaks at scale. When a national ID number is both the identifier and part of the proof of identity, a breach of this size degrades verification for an entire country.

Sources: BleepingComputer; CPR announcement; Danish Data Protection Agency.