Denmark says unauthorized CPR access exposed data on 8.8 million records

A private company's legitimate access was misused

Denmark's Central Person Register administration said an unauthorized party used a private Danish company's lawful access to retrieve names, addresses, CPR identification numbers and other data associated with about 8.8 million registered people. The administration disabled the company's access, reported the incident to the Data Protection Authority and referred it for police investigation. [1][2][3]

The figure is a count of registry records, not 8.8 million current Danish residents. The CPR system contains roughly 11 million records, including people living in Denmark, people who have emigrated and people who have died. Officials said the accessed material did not include the names and addresses of people registered for name-and-address protection. [1][4][5]

Automated searches appear to have tested valid CPR numbers

Denmark's Data Protection Authority said the CPR office notified it on October 4 that a very large number of automated lookups had been used to identify valid CPR numbers. The regulator said it was still determining what happened, how it was possible and who was responsible for the processing of personal data. [3]

The ministry said the irregular activity occurred during September and was detected on the evening of October 2. Danish-language reporting by Ritzau said the misuse continued for about 10 days, but authorities cautioned that the factual account could change as the investigation consolidates the evidence. [1][6]

The actor, entry path and downstream harm are still unknown

Officials had not identified the unauthorized party, named the company whose access was used or explained whether credentials, systems or another access mechanism were compromised. The Record and DW independently reported the government's account, but neither established who obtained the records or whether the data had been sold or used for fraud. [4][5][1]

The digitalization minister ordered a broad security review of the CPR system. Authorities advised people to be alert to phishing and never provide passwords or other confidential information merely because a caller or message already knows a name, address or CPR number. That warning describes a risk; it is not evidence that every record has already been used in a scam. [1][4]

The incident raises oversight questions about private access

The ministry said Danish law permits private companies with a legitimate interest and data-protection basis to receive specified CPR information about individually identified groups. The incident does not establish that every such access arrangement is insecure, but it shows how one authorized connection can become a population-scale exposure when controls fail. [1][4]

The pending security review will need to clarify authentication, automated-query limits, monitoring, vendor responsibility and notice to affected people. The Data Protection Authority said it could not yet assess the concrete circumstances, leaving regulatory responsibility and any remedy unresolved. [3][1]

How the sources compare