Denmark CPR Registry Breach Exposes 8.8 Million Citizens' Personal Data

What Happened

In September 2026, threat actors exploited a private Danish company’s legitimate access to the Central Population Register (CPR) system. By brute‑forcing CPR identification numbers they enumerated valid entries and extracted names, addresses, CPR numbers, dates of birth and marital status for 8.8 million individuals.

Impact

The breach affected 80 % of the 11 million records stored in CPR, including residents, expatriates and deceased persons. The exposed data can be used for identity theft, phishing and targeted attacks.

What Defenders Should Do

• Audit all third‑party access to civil registry or similar databases.
• Enforce strict least‑privilege and MFA for all privileged accounts.
• Monitor logs for abnormal enumeration or repeated failed login attempts.
• Notify affected users and authorities in accordance with GDPR and local regulations.

Mitigation Steps

Implement role‑based access controls, rotate credentials, and apply rate‑limiting on API endpoints that accept CPR numbers. Consider encrypting stored identifiers and conducting regular penetration tests against enumeration attacks.

Next Steps

Denmark’s Data Protection Agency will investigate the private company’s security posture. Defenders should stay tuned for any published advisories and update their incident‑response playbooks accordingly.