Overview
- Authorities say unauthorized parties used a private Danish company’s lawful access to extract names, addresses and CPR numbers for about 8.8 million records and that the activity took place in September before being noticed on the evening of Friday, October 2.
- The CPR administration has blocked the company’s access, reported the case to Datatilsynet, and police have opened a criminal investigation while the minister ordered a thorough security review of the register.
- Datatilsynet reported attackers performed a very large number of automated lookups to enumerate valid CPR numbers before pulling related entries, showing the breach relied on large‑scale querying rather than a direct government system hack.
- Officials warn the exposed CPR number is a permanent national identifier used for banking, healthcare and taxes so the combination of CPR, name and address raises long‑term identity‑fraud and potential national‑security risks for affected people.
- Experts and officials are calling for tighter third‑party controls, real‑time monitoring and rate limits on queries, and immediate steps for citizens including setting credit warnings, increasing vigilance to phishing, and using multi‑factor authentication where possible.