Denmark's government confirmed on October 5, 2026 that unauthorized parties accessed data from the Central Person Register, known as the CPR, TechCrunch and The Copenhagen Post report.
What officials said, per The Copenhagen Post (citing the Ministry of Research, Education and Digitalisation):
- About 8.8 million registered people were affected. That includes living residents, people who emigrated and the deceased. The register holds records on around 11 million people.
- The access came from abusing a Danish company's lawful ability to search the CPR. The CPR administration has blocked that company's access.
- The incident took place during September. The CPR administration learned of it on Friday evening, October 2.
- Exposed data includes names, addresses and CPR numbers. The register can also hold marital status, birth registration details, family relationships and church affiliation. The ministry did not say exactly which extra fields were accessed in each case.
- People registered for name and address protection were not exposed, according to the review so far.
Minister Christina Egelund called it a "deeply serious incident" and said officials are mapping its full extent and have launched measures to prevent a repeat.
Number note: TechCrunch's early report said "some 8 million". The ministry figure relayed by The Copenhagen Post is about 8.8 million, which this brief uses. TechCrunch describes it as thought to be the biggest breach in Denmark's history, and says the government did not name who is behind it.