Someone Looked Up 8.8 Million People in Denmark’s CPR Register. Here Is What We Know.

Nyhavn in Copenhagen, colorful canal houses and moored boats under a gray sky

For about ten days in September, someone used a small Danish company’s login to search Denmark’s national person register. By the time staff noticed, they had names, addresses and personal ID numbers for around 8.8 million people. That is more people than live in Denmark. ¹

Too long; didn’t read?

Denmark’s CPR register says unauthorised people got names, addresses and CPR numbers for about 8.8 million registered persons.

They did it through a private company’s legitimate access, not by breaking into the register itself.

Living people, deceased people and people who moved abroad are all included. People with address protection were not.

Police are investigating. Nobody knows yet who did it or what they plan to do with the data.

Expect better-informed scam calls and texts. A stranger knowing your CPR number proves nothing.

What the CPR register is

Every person registered in Denmark gets a CPR number: ten digits that start with their date of birth. It is used for healthcare, banking, tax and almost every public service. ⁷

The register behind it holds about 11 million records. That covers today’s residents, but also people who have died or emigrated. This is why the 8.8 million figure is higher than Denmark’s population of just over 6 million. ² ⁷

How the data got out

According to the CPR office, nobody hacked the register itself. Instead, unauthorised people used a private Danish company’s legitimate access to look people up, within the kind of information private companies are allowed to see. ¹

Some businesses are allowed that access by law. Under section 38 of the CPR Act, a company with a legitimate interest can look up people it has already identified, for example by name and address. It also needs a legal basis under data protection rules. ⁴

Denmark’s data protection authority, Datatilsynet, described what the notification said happened: “a very large number of automated lookups” against the CPR system, aimed at finding valid CPR numbers. ³

The company has not been named. Minister Christina Egelund described it as a smaller Danish company, and its access has been shut off. ⁶

The timeline so far

September: the misuse runs for roughly ten days, according to the minister. ⁶
Friday 2 October, evening: CPR staff notice irregular activity. ²
The weekend: the scale becomes clear. Datatilsynet receives the report on Sunday 4 October. ² ³
Monday 5 October: the ministry goes public. ²

What was taken, and what wasn’t

The official statement lists names, addresses and CPR numbers, plus “other information” it has not spelled out yet. ¹

One group was spared. The review so far shows the access did not include names and addresses of people who have chosen name and address protection. ¹

Nothing published so far mentions passwords, bank details or MitID logins.

What officials are saying

Christina Egelund, Denmark’s minister for research, education and digitalisation, called it “a deeply serious incident” and said she had briefed parliament’s digitalisation committee. ²

She did not defend the setup. In comments reported by Ritzau, she said it was clear to her that the security around this company’s access “had not been good enough”, and added: “It should not have been possible.” ⁶

Will Danes get new CPR numbers? She said it was too early to say, but that she was not ruling anything out. ⁶

The National Unit for Special Crime is leading the police investigation. Acting vice police inspector Nicklas Fallesen told TV 2 the scope is “quite large” and that the case has high priority. ⁸

Why it matters

Jens Myrup Pedersen, a cybersecurity professor at Aarhus University, told DR it is the largest breach ever of the Danish CPR register. ⁵

He pointed out that the data is “really effective” for phishing and identity theft. The last big CPR incident, in 2015, involved CDs sent by mistake to a Chinese visa centre. Those did not include addresses. This time they did. ⁵ ⁷

Put simply: a scammer who knows your full name, home address and ID number sounds a lot more like your bank, your doctor or the tax office.

What is still unknown

The ministry says the investigation is at an early stage and the facts may change. ² Open questions include:

who was behind it, and whether the company’s login was stolen or misused from inside;
whether the data was copied out, offered for sale or posted anywhere;
what the “other information” in the official statement covers;
whether anyone will be issued a new CPR number.

No group has publicly claimed it, and no ransom demand has been reported.

What you can do now

If you have ever been registered in Denmark, assume your record may be in this set. These steps come from the government’s own advice site, Sikker Digital. ⁹

Treat “they know my CPR number” as a warning, not proof

The ministry’s advice is clear: never give out passwords or other confidential details by phone or email, even if the person seems to know your name, address and CPR number. ²

Don’t click, call back

Ignore links in unexpected texts, emails and QR codes. If a message claims to be from your bank or a public office, close it and contact them through their official website or main number. ⁹

Keep MitID to yourself

Never share MitID details, one-time codes, passwords or card numbers. Never approve a MitID request you didn’t start yourself. ⁹

Set a credit warning

A kreditadvarsel on borger.dk marks your CPR number so lenders know to be careful about granting loans or credit in your name. It takes a few minutes. ¹⁰

Get help if something feels off

The national Cyberhotline on 33 37 00 37 has extended its hours to 8:00 to midnight for the coming days. If you think you’ve been defrauded, report it to the police. ²