On October 5, 2026, Denmark's digital affairs ministry announced that hackers had accessed the Central Person Register (CPR), obtaining personal data including names, addresses, and CPR numbers (social security identifiers) for roughly 8.8 million individuals. This figure encompasses not only current residents but also people who have died or emigrated, representing about 80% of the approximately 11 million records stored in the CPR system.
This image relates to the reported breach of Denmark's CPR system where hackers obtained personal data of approximately 8.8 million people, including deceased and emigrated individuals.
The breach occurred when intruders exploited a legitimate connection held by a Danish company that had authorized access to the CPR registry for business purposes. By abusing this trusted channel, the attackers were able to extract the sensitive information without triggering immediate alarms. The CPR administration confirmed that the unauthorized access was traced to the company's credentials.
In response, the agency revoked the company's access, engaged cybersecurity specialists and law enforcement to map the breach's scope, and reported the incident to the Danish Data Protection Authority and police. Authorities urged the public to visit sikkerdigital.dk for further information and to remain vigilant against phishing attempts, warning that even callers who know personal details should not be trusted with passwords or other confidential data.