Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account

Unauthorized parties accessed the names, addresses, and personal identification numbers (CPR numbers) of approximately 8.8 million people in Denmark's Central Person Register (CPR), including both living and deceased individuals. The breach was disclosed by Denmark's digitalization ministry on October 5, 2026. The attackers exploited a private Danish company's lawful access rights to the CPR system to retrieve the data. This represents a near-complete exposure of Denmark's entire population data. The ministry has issued guidance advising people on precautionary measures. The incident raises serious concerns about third-party access controls to sensitive national identity databases. No technical vulnerability per se was exploited; rather, legitimate access credentials or permissions of a private company were abused.