Teollimi

Danish Central Person Register (CPR) data breach

Was I affected?

Danish Central Person Register (CPR) confirmed a breach affecting about 8.8 million people, exposing names, addresses and national id numbers. You may be affected if you are, or ever were, registered in Denmark's CPR system (including if you have moved abroad), unless you had name and address protection.

Danish Central Person Register (CPR) breach facts
AnnouncedOct 5, 2026
When it happenedAbout 10 days in September 2026
CountryDenmark
People affected8.8 million
Data exposedNames, Addresses and National ID numbers
StatusConfirmed by the company or a regulator filing

What happened

Denmark's digitalisation ministry said on October 5, 2026 that unauthorized people obtained names, addresses and CPR numbers for about 8.8 million people registered in the Central Person Register, including living residents, people who have emigrated and people who have died. They did it by misusing a private Danish company's legal access to look up CPR data; the lookups ran for about ten days in September, and officials said more than 14 million searches were made, about 8.8 million of which returned a record. People with name and address protection were not affected. The company has been cut off, the Danish Data Protection Agency has been notified and the National Special Crime Unit is investigating; the company has not been named.

What should I do?

  1. Treat calls, emails and texts that quote your name, address or CPR number as suspect; a caller knowing your CPR number does not prove they are from a bank or authority.
  2. Never give out passwords, MitID codes or approve MitID requests you did not start yourself.
  3. Consider registering a credit warning (kreditadvarsel) against your CPR number at borger.dk.
  4. Ask your bank, pharmacy or other services not to accept your CPR number alone as proof of identity.
XRedditWhatsApp

More data breaches in Denmark →

Check the other services you use →

Sources