Two Danish ministers face questioning in parliament on October 27, 2026, over the theft of 8.8 million CPR numbers, as cybersecurity experts say the number can no longer verify anyone’s identity.
Denmark’s Business and Digitalisation Committee has summoned Digitalisation Minister Christina Egelund (M) and Minister for Societal Security and Preparedness Lisbeth Bech-Nielsen (SF) to a hearing over the leak. DR reports that the CPR numbers of 8.8 million living and deceased Danes were stolen earlier this month. The hearing was scheduled to begin at 12:00.
According to the committee’s own agenda published by Folketinget, the ministers must address whether the case gives reason to rethink Denmark’s digital infrastructure and the use of the CPR system. The summons follows a breach that touches almost everyone registered in the country.
Experts say the number is compromised
Jacob Herbst, chair of the Danish Cyber Security Council, Cybersikkerhedsrådet, told DR that the CPR number is compromised and that this case is the final nail in the coffin. He said it no longer makes sense to use the number to confirm identity at a pharmacy or when taking out a loan. The council proposes a ban on using the CPR number as a means of authentication.
Jan Kaastrup, a digital investigator at the cybersecurity firm CSIS, agreed that the old understanding of the system should be buried. As reported by DR, he said the idea of a secret number used to authenticate oneself at the doctor, at the pharmacy, when receiving a DSB fine or taking out a quick loan now needs other solutions. He suggested a unique number for all residents in Denmark that contains no personally sensitive information.
Both experts point to MitID as the better tool, along with the new AltID system. Herbst argues the CPR number should from now on be treated only as an identification number, a way to tell two people with the same name apart.
Caught between two stools
Herbst described the number as caught between two stools after the latest leak. On one side it contains personal information about date of birth and gender, so it cannot simply be made public. On the other side it is compromised, which he said makes it questionable to spend heavy resources protecting it going forward.
Danish authorities had already moved in that direction. The Copenhagen Post reported on October 7, 2026, that authorities said CPR numbers should no longer be used alone to verify identity, recommending alternatives such as MitID, two-factor authentication or one-time codes. Politiken has reported that the breach exposed the CPR numbers and addresses of 8.8 million people, and that pharmacies should require additional identification rather than rely on a CPR number alone.
What the CPR leak means for foreign residents in Denmark
The CPR number is the civil registration number issued to everyone who registers an address in Denmark, including foreign workers, students and family members. It is used across borger.dk, the health system, tax records and private services, and it encodes a person’s date of birth and gender. The breach of 8.8 million records covers residents regardless of nationality.
For internationals, the practical change is in how identity is checked. Based on the recommendations reported by The Copenhagen Post, giving a CPR number alone should no longer be accepted as proof of who you are, with MitID, two-factor authentication or one-time codes used instead. Politiken reported that pharmacies should ask for extra identification, and DR notes the same question applies to loans at banks.
What is not yet known is whether the government will act on the Cyber Security Council’s proposed ban on CPR-based authentication, or redesign the numbering system as Kaastrup suggested. That is the question put to Egelund and Bech-Nielsen at the hearing. Separately, a former student has stood trial for selling CPR numbers to criminals.
