Shayan

ENSV

Let's talk

Denmark’s CPR breach: 8.8 million people exposed through one company

By · Published · 2 min read

Short answer

Denmark announced on 5 October 2026 that unauthorised people had reached names, addresses and CPR numbers for about 8.8 million people in its Central Person Register. They used a private Danish company’s legitimate access. Police are investigating. A hacker later claimed the way in was the password 123456, which authorities have not confirmed.

Lessons from this story4 points ▾
  • Your supplier’s login is your riskThe intruders used a company’s legitimate access. List every supplier who can reach your data, and what they can do with it.
  • Watch for unusual volumeDenmark’s data protection agency describes huge numbers of automated lookups. Limit how much one account can read, and alert on spikes.
  • Close old accountsThe hacker claims a former employee’s password worked. True or not, accounts should close the day someone leaves.
  • Expect targeted scamsThe ministry warns people never to give out passwords by phone or email, even when the caller already knows their details.

What happened

The Danish ministry responsible for digitalisation said on 5 October that the CPR authority had found unauthorised access to data on about 8.8 million of the roughly 11 million people in the register, including people who have emigrated or died. The data is names, addresses and CPR numbers. People with name and address protection are not included, according to the ministry.

Irregular activity took place during September, and the authority learned of it on the evening of 2 October. The company’s access has been closed, the case has been reported to the Danish data protection agency, and police are investigating. The minister, Christina Egelund, has asked for a full security review of the register.

How they got in

The intruders used the legitimate access of a private Danish company, and the ministry has not named it. Denmark’s data protection agency describes a very large number of automated searches aimed at finding valid CPR numbers.

What is only claimed

An anonymous hacker told the newspaper Politiken that the way in was the password 123456, belonging to a former employee of a small company. Experts who analysed a list from the hacker say they believe the claim, according to The Local, but no authority has confirmed it.

What this means for your site

The register itself wasn’t broken into. Someone walked in through a supplier that was allowed to be there, and that can happen to any company with outside partners, agencies or system vendors.

Three checks worth doing this week:

  • List every outside account with access to your systems, and close the ones you don’t need.
  • Require two-factor login for suppliers as well as staff.
  • Set a limit on how much data one account can read, and alert on anything above it.
Contact me

Sources

  1. Danish Ministry of Research, Education and Digitalisation (opens in a new tab)
  2. The Record (opens in a new tab)
  3. The Local (opens in a new tab)

More hacks

  1. Binance

    $6.3 billion

    Most of it moved in about 20 minutes. It may have begun with one laptop.

  2. Node2Shell

    Node.js 22, 24, 26

    A flaw in the Brotli decoder inside Node.js. On CISA’s list of exploited flaws.

  3. PHP2Shell

    7 in 10 websites

    Two critical PHP flaws under active attack, CISA confirms. Patched 21 October.