Summary
Denmark’s CPR Administration says unauthorised users accessed names, addresses and CPR numbers associated with about 8.8 million registered people by misusing a private company’s lawful access to the system. The incident is under investigation, and officials have stopped the company’s access.
Denmark’s CPR Administration says unauthorised users accessed names, addresses and CPR numbers associated with about 8.8 million registered people after misusing a Danish private company’s lawful access to the national register. The Ministry of Research, Education and Digitalisation announced the incident on 5 October 2026. The company’s access has been stopped, and authorities are investigating.
The affected group includes living people, people who have moved abroad and deceased people. The CPR system holds about 11 million registered people in total. The ministry said that names and addresses for people registered with name-and-address protection were not included in the unauthorised access.
How the access occurred
The ministry says the incident involved a private company’s authorised route for searching the CPR system. Under section 38 of Denmark’s CPR Act, private companies with a legitimate interest can obtain information about a larger, defined group of people they have identified in advance. The company must also be entitled to receive the information under data-protection law.
According to the ministry, unauthorised users exploited that company access to search for information available to private businesses. The announcement does not describe the precise sequence of actions; officials say they are still mapping the incident. CPR Administration first noticed irregular system activity during September and became aware of the unauthorised access over the weekend after 2 October.
Investigation and response
CPR Administration has reported the incident to Denmark’s Data Protection Agency and is working with specialists and relevant authorities to establish what happened. Police are investigating. The ministry says measures have been initiated for the CPR system to help prevent similar incidents, and a broader security review is being launched to inform any further action.
Officials have advised people not to disclose passwords or other confidential information in response to phone calls, emails or similar contact—even if the person making contact appears to know their name, address or CPR number. The ministry directed people to Denmark’s sikkerdigital.dk service for guidance. It also listed the Cyber Hotline for Digital Security at +45 33 37 00 37, with extended hours of 8:00 to 24:00 in the days following the announcement.