The number of people in Denmark with a credit warning registered on their CPR number has jumped from nearly 250,000 to about 970,000 in one week, following unauthorized access to data on 8.8 million registered people.
The figures come from a statement by the Ministry of Research, Education and Digitalization, sent to the news agency Ritzau and reported by DR on October 8, 2026. On October 1, before the breach became public, just under 250,000 residents had a credit warning.
By the most recent count, dated October 7, around 970,000 people were registered with one. That is close to a fourfold increase in seven days, according to the ministry’s own tally.
How the CPR register access was discovered
The case became public on Monday, when it emerged that outsiders had misused a small Danish company’s legal access to the CPR register. Per DR, the access took place over a period of about ten days in September 2026.
Authorities spotted the problem because of an unusually expensive invoice. Each search a company makes in the CPR register costs money, and the large bill revealed that extensive searches had been carried out. The authorities have not named the company involved.
The ministry has stated that the information obtained was primarily names and addresses. The CPR register also holds data such as marital status, birth registration details, family relations, membership of the Danish state church, citizenship and any guardianship arrangements. The system contains roughly 11 million registered people, including those who have died and those who have moved abroad.
Hotline hours extended after the breach
The Agency for Societal Security has recommended that people with a concrete suspicion of fraud set up a credit warning after the leak of 8.8 million CPR numbers. A credit warning is a marking in CPR that makes it harder for someone to take out loans or credit in another person’s name.
The same agency has extended the opening hours of its Cyber Hotline for Digital Security in the days following the breach. It can now be reached on weekdays between 08:00 and midnight on 33 37 00 37, instead of the usual 08:00 to 20:00, according to DR.
What the CPR breach means for internationals in Denmark
The CPR number is the personal identification number issued to everyone registered in Denmark, including foreign workers, students and family members. It is used for tax, healthcare, housing contracts and banks, which makes it central to both daily life and to identity misuse when it falls into the wrong hands.
Because the register covers around 11 million people, including those who have moved abroad, internationals who hold or once held a Danish CPR number can be among the affected. The Agency for Societal Security’s recommendation to create a credit warning applies to people with a concrete suspicion that their data has been misused, not to everyone in the register. The authorities have not published a breakdown of how many of the affected 8.8 million are foreign nationals, and they have not named the company whose access was abused.
