Denmark gave a private company access to the national register. Someone else used it to look up 8.8 million people.

On the evening of Friday 2 October 2026, administrators of Denmark's Central Person Register (CPR) noticed an unusual spike in automated queries. The activity traced back to the account of a private Danish company that holds authorised access to the register. Unauthorised parties had taken over that access and, over roughly ten days in September, used automated lookups to work through the register and identify valid CPR numbers. The register's administration suspended the company's access, the Danish Data Protection Agency (Datatilsynet) was notified on 4 October, and the ministry went public on 5 October.

No malware or software vulnerability has been reported. The attackers worked inside the boundaries of what a private firm is normally permitted to see, using credentials that the system already trusted. Every query looked like a legitimate customer asking a legitimate question. The only difference was the volume and the speed, driven by automation rather than by the company's own staff.

The data exposed covers living residents, people who have moved abroad and deceased persons. Individuals with name and address protection were not affected. Names, addresses and CPR numbers are the raw material for identity fraud, targeted phishing and impersonation, and the CPR number in particular is used across Danish banking, healthcare and public services as a proof of identity. No attribution has been made, and the police are investigating alongside the data protection authority.

The defences that failed here were not weak by conventional standards. The company held an approved, vetted access arrangement. The credentials were valid. The queries stayed within the register's normal scope for private users. Monitoring did exist, and it did eventually fire, but only after ten days of access and a large fraction of a national database had already left. Minister Christina Egelund conceded that alarms should have triggered earlier given the duration of the activity. Authentication proved that the account was real. Nothing proved that the person behind it was the authorised user, or that this particular use of it was approved.

The bulk lookup is an execution event. Before a company's account can run automated queries against the register at scale, a confirmation request goes to the named authority at that company, on their registered device, and requires their biometric confirmation. The same applies to any change in query pattern: a jump in volume, a new automated client, a request to enumerate identity numbers. The authority sees what is being requested and from which account, and confirms or refuses. If no confirmation arrives, the lookups are blocked and no record leaves the register.

An attacker holding a stolen credential, however valid it looks to the system, cannot produce that confirmation. The named authority's registered device sits on a separate channel, and the biometric is theirs alone. The execution boundary holds regardless of how legitimate the compromised account appears.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Khandelwal, S. 2026. Denmark says attackers accessed CPR data for 8.8 million people via company account. The Hacker News, 6 October 2026.
2. Markovic, S. 2026. Data breach at Denmark's population register exposes 8.8 million people. Help Net Security, 6 October 2026.
3. The Local Denmark. 2026. What you need to know about Denmark's national registry hack. The Local, 5 October 2026.