The number of people in Denmark with a credit warning has risen by 1.1 million since the theft of data from the CPR register, bringing the total to nearly 1.4 million.
The attack on the CPR register exposed names, addresses and CPR numbers belonging to around 8.8 million people. DR reported on November 3 that the number of residents applying for a credit warning has climbed sharply since the breach became public.
Before the leak, just under 250,000 people had a credit warning registered. According to DR, the figure now stands at almost 1.4 million applications, an increase of 1.1 million. A credit warning is a marker that makes it harder to take out loans or credit in someone else’s name.
How the CPR register was accessed
About a month ago it emerged that unauthorized parties had reached the CPR register through a Danish company. DR reports that the company was the Funen-based firm Pays, where an employee had the password 123456. Two-factor verification was not required to reach the information.
The unauthorized access took place over ten days. The Register reported that the breach was announced on October 5, 2026, after unusually high activity generated a large invoice for the company.
The Copenhagen Post reported that credit warnings had almost quadrupled to about 970,000 by October 7. The same outlet reported that the Agency for Societal Security recommended the marker for people with concrete reasons to suspect fraud.
Minister for Research, Education and Digitalization Christina Egelund of the Moderates has previously said the step is not necessary without suspicion. As reported by DR, she said last month that people who have experienced nothing unusual have no reason to apply, because the marker also carries a drawback.
That drawback is practical. A credit warning can make it harder for the person who holds it to obtain a loan or credit. The marker can be removed again, but according to DR this can take some time.
What the CPR breach means for foreign residents in Denmark
The CPR register covers everyone with a Danish personal registration number, including internationals on work, study and family residence permits. The CPR number is used for banking, tax, healthcare and public services, which is why its exposure raises the risk of identity misuse in financial matters. The breach involved names, addresses and CPR numbers of about 8.8 million people, a figure larger than Denmark’s population, as the register also holds records of people who have left the country.
Applying for a credit warning requires logging in with MitID on borger.dk, the national self-service portal. Residents who have not activated MitID cannot complete the process online. For anyone considering a loan, a mortgage or a new account with a bank in Denmark, the marker is the same obstacle for the account holder as it is for a fraudster.
The official guidance remains narrower than the public response. The Agency for Societal Security recommended credit warnings for people with concrete reasons to suspect fraud, per the Copenhagen Post, and Egelund said the step is unnecessary without such suspicion. What is not yet known publicly is how the stolen data has been used, or whether specific groups of residents have been targeted.
