Denmark's CPR data breach exposed names, addresses and national identification numbers relating to about 8.8 million registered people, according to authorities cited in [BleepingComputer's October 5 report](https://www.bleepingcomputer.com/news/security/denmark-population-registry-data-breach-affects-88-million-people/). Unauthorized users abused a private Danish company's legitimate access to the national population register.

The register holds around 11 million records, including living residents, people who moved abroad and deceased individuals, the Danish digitalisation ministry said. Officials detected irregular activity on October 2 and established over the weekend that unauthorized access had occurred during September. The ministry said investigators could not yet identify those responsible.

The [Danish Data Protection Agency](https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-er-opmaerksom-paa-sag-om-opslag-i-cpr) said the notification it received on October 4 described a very large number of automated searches intended to identify valid CPR numbers. It is examining how the incident happened and who was responsible for the processing of personal data. The agency said it was too early to assess the specific circumstances.

According to the ministry, the access was limited to information available through the company's authorized search facility. Its review found that names and addresses belonging to people registered for name and address protection were not accessed. That finding concerns those protected fields; the statement does not establish that every category of information about those individuals was unaffected.

The CPR administration revoked the company's access, and police are investigating with relevant authorities, the ministry said. Minister Christina Egelund ordered a thorough security review. [The Record](https://therecord.media/denmark-breach-register-cyberattack) reported that CPR numbers are used across healthcare, banking and government services, giving the exposure consequences across multiple sectors.

The [ministry's guidance](https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/) warns residents against disclosing passwords or confidential information to callers or email senders, even when they know the recipient's name, address and CPR number. It directs residents to sikkerdigital.dk for advice while the investigation continues.