Short answer
Denmark's Ministry of Research, Education and Digitalisation said on 5 October 2026 that unauthorised parties misused a private company's legitimate access to the CPR register. Names, addresses and CPR numbers of about 8.8 million people were exposed, and police and the data protection agency are investigating.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Danish Central Person Register (CPR) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Government population register |
| Country | Denmark |
| Detected | 2026-10-02 |
| Disclosed | 2026-10-05 |
| People or records affected | About 8.8 million people, roughly 80% of the register's 11 million records |
What data was exposed
- Names
- Addresses
- CPR numbers (10-digit personal identification numbers)
What happened
On 5 October 2026, Denmark’s Ministry of Research, Education and Digitalisation disclosed that personal data from the Central Person Register (CPR) had been exposed. According to Help Net Security, irregular activity took place in September. The CPR administration learned of it on Friday 2 October, established the extent of the access over the weekend and notified the Danish Data Protection Agency on Sunday 4 October.
The ministry says the data was not taken by breaking into government systems. Instead, unauthorised parties misused the legitimate access that a private Danish company has to search the register. That company’s access was blocked. The reports we checked do not name it.
What was exposed
Names, addresses and CPR numbers of about 8.8 million people, roughly 80% of the register’s 11 million records. The group includes living residents, people who emigrated and deceased people. The ministry says searches stayed within the information private companies may retrieve, and that people with name and address protection were not affected based on the review so far. The register can also hold items such as marital status and family relationships, but authorities have not said those were accessed.
Official response
Minister Christina Egelund called it a deeply serious incident and requested a thorough security review of the CPR system. Police are investigating, and Datatilsynet opened a case. No suspect or motive has been announced. Authorities said they were still mapping the full extent.
Why it matters for scams
A CPR number is Denmark’s key personal identifier, and many calls and forms treat it as a proof of identity. With name, address and CPR number together, a fraudster can sound convincing on the phone. The ministry warns that the data could be used in fraud and tells people never to hand over passwords or confidential information, even to a caller who knows these details.
What to do
Follow the ministry’s advice and the guidance at Sikkerdigital.dk. Do not approve MitID prompts you did not start, and be wary of any message that asks you to confirm your CPR number.
The breach landed in the same month as the DTU data breach and the University of Copenhagen breach. Read our data breach checklist and the guide to government impersonation scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls, emails or texts from someone who knows your name, address and CPR number and claims to be your bank, the police or a public authority.
- Phishing messages that ask you to confirm your CPR number or approve a MitID request.
- Identity fraud, such as loan or subscription applications made with your CPR number.
What to do if you are affected
- 01Never give passwords or confidential information by phone, email or similar channels, even if the person knows your name, address and CPR number.
- 02Do not approve any MitID or login request you did not start yourself.
- 03Do not rely on a CPR number alone to prove who you are when you contact organizations.
- 04Follow the official guidance at Sikkerdigital.dk and consider a credit alert on your CPR number at Borger.dk.
Frequently asked questions
How did the CPR breach happen?
The ministry says unauthorised parties misused a private Danish company's legitimate ability to search the CPR register. It did not name the company in the reports we checked, and the company's access was cut off.
Were people with name and address protection exposed?
Based on the review so far, no. Authorities said people with name and address protection are not included, but the full extent was still being mapped.
Do I get a new CPR number?
We found no official statement offering new CPR numbers. Authorities instead advise vigilance and say not to treat a CPR number alone as proof of identity.
Who is investigating?
Police are investigating with other authorities, and the Danish Data Protection Agency (Datatilsynet) opened a case on what happened, how it was possible and who is responsible for processing the data. No suspect has been named.
Sources
- CPR data breach exposes personal details of 8.8 million people in Denmark, The Copenhagen Post, 2026-10-05
- Data breach at Denmark's population register exposes 8.8 million people, Help Net Security, 2026-10-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.