Denmark reports unauthorized CPR access covering 8.8 million people

What Denmark has confirmed

On October 5, Denmark’s Research, Education and Digitalisation Ministry said unauthorized parties had gained access to names, addresses, CPR numbers and other information associated with about 8.8 million people registered in the Central Person Register (CPR). The ministry says the access came through misuse of a Danish company’s lawful permission to query the register.

The 8.8 million figure is the ministry’s stated affected population. Its announcement does not establish that every listed field was returned for every person, that a complete copy of all those records was exported, or that each record was subsequently used. The ministry says it is still mapping the incident and cautions that details may be consolidated as that work continues.

CPR holds about 11 million registered people, including people who live abroad and people who have died. The ministry says its review found that names and addresses of people registered with name and address protection were not included in the unauthorized access. That statement is specific to those fields.

Detection and response

The ministry says CPR administrators became aware on the evening of October 2 that activity in the system had been irregular during September. A weekend review established that unauthorized access had occurred. CPR stopped the company’s access, reported the incident to Denmark’s Data Protection Agency, and is working with specialists and authorities to map what happened. The ministry also ordered a security review of the register. Police are investigating with relevant authorities.

What the regulator says

The Data Protection Agency says it received a report from the CPR register on October 4. According to that report, a very large number of automated queries targeted the system to identify valid CPR numbers. The agency says it is examining what happened, how it happened and who was responsible. It has not yet assessed the specific facts or assigned liability.

The public disclosures do not name the company or the people behind the activity, explain an initial-access method, or establish that all queried identifiers were retrieved as complete records. They provide no basis to attribute the incident to an AI system. Those questions remain open while the authorities investigate.