Denmark has confirmed unauthorized access to personal information concerning around 8.8 million people in its Central Person Register, known as CPR. A private company’s legitimate lookup access was misused, highlighting why organizations must govern external accounts and monitor data requests.
What information was affected?
The Danish Ministry of Research, Education and Digitalisation announced the incident on 5 October 2026. Names, addresses and CPR identification numbers were accessed. The register includes deceased people and those who moved abroad, so the affected total is not Denmark’s current population. The ministry said protected names and addresses were outside the unauthorized access identified in its review. Read the government announcement.
A trusted access channel was misused
The confirmed route involved a Danish private company’s lawful lookup permissions. Authorities disabled that access and reported the incident; police are investigating. These findings establish misuse of an authorized channel, rather than establishing that CPR’s core database defenses were directly breached.
In a separate 5 October statement, the Danish Data Protection Agency, Datatilsynet, said it received notification the previous day describing extensive automated lookups. Its examination of the circumstances and responsibility was still at an early stage. Read the regulator’s statement.
CPR reminds businesses to review access
On 9 October, CPR reminded participating companies to appoint a security lead, limit employee access to business needs, review permissions continuously and monitor monthly transaction volumes. Its letter also describes the MitID authentication requirement for publicly accessible self-service functions that initiate CPR lookups. Read CPR’s official letter (PDF).
Practical lessons for Hong Kong organizations
Organizations handling customer records should inventory supplier accounts, remove dormant access and require unique, strong passwords with multifactor authentication. Set sensible limits on bulk queries and alert on activity that differs sharply from an account’s normal use. These are general defensive recommendations, not findings about the unresolved cause of this incident.
For individuals, leaked identity details can make fraudulent calls sound convincing. Denmark’s health authority reminded providers that a person’s name and CPR number alone should not justify releasing further information. Verify unexpected requests through an official contact channel and never disclose passwords or one-time codes. Read the health-sector notice.