On 5 October 2026, Denmark's Ministry of Research, Education and Digitalisation announced that someone had misused a Danish private company's legitimate access to the Central Person Register (CPR) to obtain names, addresses and CPR numbers for about 8.8 million registered people. The CPR administration noticed irregular activity from September on the evening of Friday 2 October, confirmed unauthorized access over that weekend, and cut off the company's access.
The register itself was not hacked in the usual sense. A partner account with permission to search it was used to search far more than it should have.
What's affected
From the ministry's press release:
- System: Denmark's Central Person Register, which holds about 11 million records covering living residents, people who have emigrated and deceased people.
- People: About 8.8 million registered people. The ministry said the figures may be refined as the investigation continues.
- Data: Names, addresses and CPR numbers, among other data.
- Not affected: People registered with name and address protection, based on the review so far.
- Access path: A private company's access under section 38 of the CPR Act, which lets companies with a legitimate interest receive CPR data about a limited group of people they have identified in advance.
- Response: The company's access was stopped, the Danish Data Protection Agency (Datatilsynet) was notified, police are investigating and the minister ordered a security review of CPR.
Later reporting added detail. According to Danish outlet sn.dk, citing Politiken and the CPR office's report to Datatilsynet:
- The company was a small private IT firm.
- The access lasted 21 days and 17 hours, though the attacker did not use it for that whole period.
- Entry used a leaked password belonging to a former employee.
- Politiken reported that several of the company's accounts used a trivial password, including its administrator account.
The same report says the CPR administration wrote to 1,039 companies with registry access, reminding them to appoint a security officer, regularly check employees' access, and monitor monthly CPR transaction volumes to spot misuse.
How to check if you're exposed
If you are a Danish resident, the ministry's advice is direct: never share passwords or other confidential information by phone, email or similar channels, even if the caller already knows your name, address and CPR number.
If you run a platform that grants partners access to data, or you are a partner with that access, check these:
- Leaver accounts. Find accounts that belong to people who have left. In most identity providers you can export users with their last sign-in date and compare against your HR leaver list:
# Example: users with no sign-in for 90 days, from an IdP export
python3 -c "
import csv, datetime as d
cut = d.datetime.now() - d.timedelta(days=90)
for r in csv.DictReader(open('users.csv')):
last = r['last_sign_in'] or '1970-01-01'
if d.datetime.fromisoformat(last[:10]) < cut:
print(r['email'], last)
"
- Shared and weak passwords. Test your partner-facing accounts against known breached and trivial passwords. If your system allows "123456" on an administrator account, the control failure is in the system, not only the user.
- Query volume per account. Pull monthly lookup counts per partner and per user. An account entitled to look up a limited group of people should never approach the size of your whole dataset.
What to do now
- Disable leaver accounts the day someone leaves, at every partner too. Your offboarding does nothing for accounts your partners issue to their own staff. Require partners to attest to this quarterly.
- Enforce MFA and a password policy on partner access. Do not leave it to each partner's discretion.
- Put hard rate limits on bulk lookups. If a partner's legitimate use is a few thousand queries a month, cap it near that and alert when the cap is approached.
- Name a security owner at each partner. This is one of the three things the CPR administration asked of the 1,039 companies. It gives you someone to call.
- Log and review per-user activity. You cannot spot "one account searched most of the country" without per-user transaction logs that someone actually reads.
Why it matters
Every API key, service account or portal login you give a partner extends your attack surface into their security program. Here the partner's access was granted under section 38 of the CPR Act. What failed, according to the reporting so far, was account hygiene at one of more than a thousand companies with access.
The fix is to treat partner access like any other privileged access: scoped to what the partner needs, rate limited, monitored per user and reviewed regularly. The CPR administration's letter to 1,039 companies is a public example of that review happening after the fact.
Try it yourself
Export the list of external organizations that hold credentials to any of your data systems. For each, write down how many active user accounts they have, when the oldest one last signed in, and what their normal monthly query volume is. The first organization where you cannot answer all three is where to start.
Click through it at your own pace, or open it full screen.
Quick check
Was the CPR system itself hacked?
According to the ministry, someone misused a private company's legitimate access to search CPR data. The company's access was then stopped.
What did the CPR administration ask other companies with access to do?
According to sn.dk, it wrote to 1,039 companies reminding them to appoint a security officer, regularly check employees' access to registry data, and monitor monthly transaction volumes to detect misuse.
Were people with address protection exposed?
The ministry said the review so far shows names and addresses of people with name and address protection were not exposed.
