Danish national registry

Summary

Hackers used a Danish company's lawful access to Denmark's Central Person Register to exfiltrate names, addresses, and CPR numbers for approximately 8.8 million people during September 2026. The abnormal activity was discovered in early October, and no threat actor was identified.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Denmark’s Central Person Register (CPR) announced on Monday that personal information belonging to approximately 8.8 million people had been stolen in a data breach. Established in 1968, the CPR is Denmark’s national civil registration system and contains information on roughly 11 million people, including residents, emigrants, and deceased individuals. The affected population included both living and deceased registered individuals. The announcement followed the discovery of abnormal behavior within the population register during September. The CPR was notified of the unusual activity on Friday and began determining the cause and scope of the incident over the weekend.

CPR determined that hackers had used a Danish company’s lawful access to the register to obtain and exfiltrate personal information. Under Danish law, private companies with a legitimate interest may gain access to CPR records about specific individuals. Companies may also request information under Denmark’s Data Protection Regulation and Data Protection Act. The investigation identified the exposed information as names, addresses, and CPR numbers for approximately 8.8 million registered people. CPR numbers are the Danish equivalent of Social Security numbers in the United States.

The breach affected a substantial portion of the records held by the national register, covering about 8.8 million of the roughly 11 million people included in the system. It was not limited to current residents, as deceased individuals were also among those affected. People who had registered with the name and address protection option were not affected by the incident. The CPR also communicated that people should be wary of unsolicited communications requesting personal information, passwords, and other sensitive data.

Immediately after discovering the incident, CPR terminated the private company’s access to its systems. The register notified the Danish Data Protection Agency and launched an investigation with the police and other relevant authorities. The termination of access was followed by a review of CPR’s security policies and planned improvements intended to prevent a similar incident. The investigation also examined how the company’s authorized access was used by the attackers.

CPR said that it had not been able to identify the threat actor behind the data breach and did not name one in its announcement. The public notification confirmed the theft of personal information from the national civil registration system and placed the number of affected individuals at approximately 8.8 million.

Sources

Sources available to members: 1 source.