Massive Data Breach Exposes Personal Records of Eight Million Danes

Scope and Details of the CPR Hack

The Danish authorities have confirmed that a breach of the Central Person Register (CPR) resulted in the theft of a large portion of the database, affecting roughly eight million citizens and residents. The compromised dataset includes individuals living abroad and even deceased persons, reflecting the comprehensive nature of the register.

Minister Christina Egelund described the incident as a “serious breach,” noting that the stolen information comprised full names, residential addresses, national social security numbers, and additional personal details.

The CPR serves as the primary repository for government‑issued identity numbers used for tax filing and access to public services. Although Denmark’s current population stands at about six million, the register holds records for approximately eleven million individuals, some dating back several decades.

According to the government, the unauthorized access was achieved by exploiting a legitimate connection granted to a Danish company that regularly queries the CPR to verify citizen data. Officials declined to identify the perpetrators or provide a precise timeline, except to state that the intrusion occurred in September and was detected on October 2.

This breach is regarded as the largest data incident in Danish history. It echoes previous attacks on national identity databases elsewhere, such as the 2016 compromise that exposed millions of Turkish citizens’ records and multiple leaks from India’s Aadhaar system.