Danish CPR register hacked, personal data of about 8.8 million exposed

The Danish central registry of people and addresses has been breached, and unauthorised parties obtained personal data for roughly 8.8 million registered individuals, the Ministry of Digitalisation said on Monday.

In an official statement the ministry reported that "The National Registry (CPR) has established that unauthorised persons illegally obtained access to the names, addresses and CPR numbers (equivalent to the social security number) of around 8.8 million registered persons - living, deceased, persons who emigrated, etc."

Authorities said the data were obtained through legitimate credentials held by a Danish company; that company's access has since been blocked while investigators work to establish the full scope of the breach. The perpetrators have not yet been identified.

Investigation under way, officials warn of seriousness

The registry operator notified the relevant authorities after detecting an "anomaly" in its system; the irregularity first appeared during September and was reported to the registry on a Friday, the ministry said. An ongoing investigation is attempting to determine when and how the breach occurred and whether further systems were affected.

Kristina Egelund, Minister for Digitalisation, described the incident bluntly: "This is an extremely serious incident." Officials declined to give further operational details while the probe continues.

The ministry said it had taken immediate technical steps to block the compromised access and is coordinating with other agencies to assess risks and next steps for affected individuals. The inquiry remains open and authorities say they will release more information as it becomes available.

Photo: press material from the event