CPR register

Denmark's CPR register, which holds citizens' personal ID information, has suffered unauthorized access affecting roughly 8.8 million people — more than the country's entire population, indicating data on deceased residents was also exposed. The Danish Civil Registration System confirmed the breach and is investigating its scope. The incident is drawing major attention given the sensitivity of CPR numbers and the near-total exposure of the population's personal data.

Danish authorities have opened an investigation into a data breach involving the CPR personal identity registry, which affects roughly 8.8 million people — nearly the entire population of Denmark. The breach involves the central register holding citizens' personal identification numbers. Details about how the data was exposed and who is responsible have not yet been made public as the inquiry continues.

The CPR has confirmed that personal information belonging to its entire registered population has been exposed in a data breach. The confirmation raises concerns about how centralized registries holding sensitive personal data are secured, and cybersecurity observers are urging organizations to review what personal data they store and who has access to it. The full scope of the exposed records and the number of people affected beyond the registered population is not yet known.

Unauthorized actors abused a private company's legitimate access to Denmark's Central Person Register, running automated searches to pull names, addresses and CPR numbers linked to 8.8 million registered individuals. The scale of the breach, covering a large share of Denmark's population, is prompting concern over how sensitive registry access is monitored and controlled.

Denmark's Central Person Register (CPR) has announced extensive unauthorized access to citizens' CPR data, the national registry holding personal identity numbers. The agency published a news notice about the incident, which security observers are flagging as a significant data breach involving sensitive personal information. The scale of exposure and the number of affected citizens have not been detailed in the notice.