Denmark CPR Database Breach Exposes Records of 8 Million People

The Danish government confirmed that its central database of citizens’ data was breached and that most of its contents were stolen. The breach affects some 8 million citizens and residents of Denmark, including people living abroad and the deceased. The stolen data includes names, addresses, Danish social security numbers, and other information.

The affected system is Denmark’s Central Person Register, or CPR. It stores citizens’ information, including the government-issued identity number used for paying taxes and accessing other services. Although Denmark’s current population is about 6 million, the database includes records for about 11 million people, with some data going back decades.

The breach happened in September and was discovered on October 2, according to the report. The Danish government would not say who was behind the incident. It said the unauthorized access was obtained by abusing a Danish company’s lawful access to search for information in the CPR system, a type of access some companies use to verify people’s information with the government.

The breach is thought to be the biggest in Denmark’s history. It highlights the risk of large national identity databases, especially when outside organizations have legitimate access that can be misused. For readers, the key takeaway is that identity-number exposure can create long-term privacy and fraud risks because these records are difficult or impossible to replace.