CPR’s trusted access is Denmark’s unanswered security problem

Denmark’s Central Person Register, or CPR, was breached after attackers abused a Danish company’s legitimate access to the system. The government says attackers stole most of the database’s contents, affecting about 8 million citizens and residents, including people living abroad and people who are deceased.

The incident occurred in September 2026 and was discovered on October 2, 2026. Denmark’s government confirmed the breach publicly on October 5. It described the compromise in a public statement, but has not identified the company whose authorized access was abused, the attackers, or the mechanism used to collect the records.

The stolen material includes names, addresses, Danish social security numbers, and other unspecified information. CPR is not a service-specific database: its government-issued identity numbers are used for tax payments and access to other services. The breach leaves unanswered questions about access controls.

“serious incident”

Eight million affected is not the same as Denmark’s population

Denmark has a current population of about 6 million, but CPR holds approximately 11 million records accumulated over decades. The registry includes entries for people outside Denmark and deceased people, so population is a poor proxy for the database’s scope.

The government puts the affected population at about 8 million, while saying that most of CPR’s contents were stolen. It has not explained why roughly 3 million registry entries fall outside that affected count, whether all fields were taken for every affected entry, or what the unspecified additional information contains. A count of people, a count of database records, and a claim that “most” content was obtained are not interchangeable measurements.

Recommended reading

OpenAI’s agent problem is now an enforcement problem

Sergey Kuznetsov • Oct 4, 2026 • 6 min read

The government believes this may be the largest data breach in Danish history. That assessment is based on the breadth of a national identity registry, not a large customer list from a single commercial service.

The failure was in authorized access

Attackers abused a Danish company’s lawful ability to search CPR information. Some companies are granted that capability to verify customer or citizen details against government records. The access itself was permitted; the collection of data through it was not.

The available account does not say whether the abuse involved compromised credentials, misuse by an insider, a weakness in the company’s own systems, insufficient controls around legitimate searches, or another route. It also does not disclose query-rate controls, export limits, audit logging, the time required to extract the material, or whether the company’s access has been disabled.

Without those details, containment cannot be meaningfully assessed. A national registry can restrict direct public access yet still be broadly exposed if trusted organizations can retrieve records at a scale that is difficult to distinguish from legitimate verification work. Denmark has established that a trusted access path was abused; it has not established how that path became a bulk-data channel.

A larger historical number needs context

Denmark’s breach has drawn comparison with a 2016 Turkish case involving an online database said to contain personal information for about 50 million citizens. The two events should not be treated as equivalent precedents. Denmark has confirmed an intrusion into CPR, while Turkish prosecutors opened an investigation into an alleged leak and Turkish officials disputed that the data came from the country’s central civil-registration system, MERNIS.

The Danish incident is also different from the up to 8.7 million customers affected in the Manchester Airports breach reported on August 29, 2026. That case involved contact, postcode, and vehicle data across airport services, with banking and financial information said to remain secure. CPR instead holds a government identity number used across public services. The two totals are similar; the systems and data roles are not.

Denmark has not said whether affected people will receive new identity numbers, whether it will alert every person with a compromised record, or whether it has found evidence that the stolen data has been published or used. It also has not named the company whose legitimate access was turned against CPR.