Unauthorized parties have gained access to names, addresses and CPR numbers belonging to around 8.8 million people registered in Denmark, the Danish Ministry of Research, Education and Digitalisation says.
The ministry disclosed the incident on Monday, October 5, 2026. According to DR, the compromised information includes names, addresses and CPR numbers from the Danish civil registration system.
The ministry describes the case as a deeply serious incident. As reported by DR, the roughly 8.8 million registered people include living residents as well as deceased and emigrated persons. That figure is larger than Denmark’s population because the CPR register keeps records after death and emigration.
How the access happened, according to Danish media
Politiken reports that the access was obtained by misusing a private Danish company’s legitimate permission to search the CPR system. In other words, the entry point was an existing authorized connection, not a public-facing service.
Per Ekstra Bladet, the company’s access has been shut off. The incident has been reported to the Danish Data Protection Agency, Datatilsynet, and is being investigated by police. Ekstra Bladet also notes that people registered with name and address protection are not included in the incident.
TV 2 reports that CPR Administration registered irregular activity in the system during September. The authority became aware of the activity on Friday and established over the weekend that unauthorized access had taken place. According to TV 2, the people behind the access have not been identified and the case remains under investigation.
Minister has briefed a Folketinget committee
The disclosure comes days after the irregular activity was confirmed as unauthorized access. Politiken reports that the Ministry of Research, Education and Digitalisation has classified the case as a serious security incident. According to the same outlet, Minister Christina Egelund has briefed the Folketinget’s Business and Digitalisation Committee, the Erhvervs- og Digitaliseringsudvalg.
What the CPR breach means for internationals in Denmark
The CPR number is the 10-digit personal identification number issued when a person is registered in Denmark’s Central Person Register. It follows residents through the health system, the tax authorities, borger.dk, MitID and employment records. It is also required to open a bank account and to receive a yellow health insurance card.
Because the register covers everyone who has been registered in Denmark, foreign residents with a CPR number fall inside the same system described by the ministry. The figure cited by DR also covers people recorded as emigrated, which can include internationals who have since left the country. Those with registered name and address protection are excluded from the incident, according to Ekstra Bladet.
Several questions are still open. The named sources list only names, addresses and CPR numbers as the affected data categories, and none of them reports a compromise of MitID credentials or passwords. TV 2 states that the identity of those behind the access is unknown, and the case is being handled by police and Datatilsynet.
The ministry has not published, in the reporting available on October 5, any individual notification process for affected people. DR is running a live blog on the case, and the ministry’s assessment of the incident as deeply serious is the clearest official characterization so far. Further details are expected to come from the police investigation and from Datatilsynet’s handling of the report.
