COPENHAGEN, DENMARK / RankWire.AI / – In recent developments, Danish authorities are expanding their probe into a significant security incident involving the country’s Central Person Register. Unauthorized individuals gained access to personal information related to approximately 8.8 million residents. The compromised data included names, addresses, CPR numbers, and associated records. Officials indicated that the attackers exploited a lawful access point of a private Danish enterprise to search the CPR system. In response, the CPR administration has suspended the company’s access while investigations analyze the incident’s root causes.
The CPR authority identified suspicious activity on the evening of Oct. 2, following unusual search patterns observed in September. Over the weekend, officials reviewed the activity, confirming the extent of the breach. The Central Person Register holds roughly 11 million records, covering current residents, individuals who have moved abroad, and deceased persons. Authorities stated that the searches remained within the scope of information that private firms are permitted to access via authorized CPR services.
No attribution has yet been made regarding who executed the activity. Danish officials have not disclosed the private company whose lawful access was exploited. The CPR administration notified Datatilsynet, Denmark’s data protection agency, and law enforcement agencies are conducting investigations alongside other relevant bodies. The government emphasized that its review found no exposure of names and addresses covered by Denmark’s name and address protection scheme.
Regulatory body scrutinizes automated CPR system queries
Datatilsynet announced it received the incident report from the CPR register on Oct. 4. The agency stated that the incident involved a large volume of automated searches targeting the CPR database. The purpose of these searches was to verify valid CPR numbers, as indicated in the notification. Datatilsynet is now examining the circumstances that enabled the access, identifying responsibility, and determining what went wrong. The regulator pledged to provide further updates once there is enough information to do so.
Research, Education and Digitalisation Minister Christina Egelund characterized the breach as highly serious and briefed the parliament’s Business and Digital Affairs Committee. She has also ordered a comprehensive security review of the CPR system. While authorities are assessing the event, the government has implemented measures aimed at preventing similar breaches in the future. The CPR administration continues to map out the sequence of events, noting that the investigation is still in its early stages, and the technical review may refine initial findings.
Officials warn public to stay vigilant against scams
Danish officials have advised residents to be cautious of potential fraud schemes, including deceptive calls, emails, and messages that could leverage exposed personal data. They emphasized that individuals should never share passwords or other sensitive information simply because someone claims to know their name, address, or CPR number. The government recommended consulting official digital security guidelines and Denmark’s cyber hotline for assistance. This warning was issued after confirmation that the unauthorized activity involved data belonging to millions registered in the national population system.
Authorities continue to investigate the method of access, the scope of affected records, and the safeguards surrounding private-sector use of the CPR database. Additionally, Datatilsynet is independently examining the data protection implications of the breach. The CPR administration has revoked the company’s access and initiated security protocols, while officials conduct a broader review of the registry. As of Oct. 7, no public identification of the attackers, the private company involved, or details about the specific method used to misuse authorized access has been disclosed.