Denmark's Central Person Register (CPR) administration and the Ministry of Higher Education, Research and Digitalisation announced on 5 October 2026 a serious security incident: unauthorised parties misused a Danish company's legitimate access to search the CPR system and obtained names, addresses, CPR (personal identity) numbers and other details for about 8.8 million people registered in CPR. The figure is higher than Denmark's population of roughly six million because the register also holds deceased people, people who have emigrated and others.

People registered with name and address protection are not included, according to the review so far. CPR staff noticed irregular activity in the system on Friday 2 October, covering a period in September; minister Christina Egelund told Ritzau the access ran for about ten days through a smaller company's account and acknowledged security failings.

The company's access has been shut off, the case has been reported to the Danish Data Protection Agency (Datatilsynet), police are investigating, the parliamentary digitalisation committee has been briefed and a full security review of CPR has been ordered. The company, the attackers and how many records were actually extracted have not been named. Authorities warn people never to give out passwords or codes by phone or email, even when the caller already knows their name, address and CPR number.

Separate from the DTU incident on this desk. Wire: Cybersecurity News 5 Oct. CORRECTION (21 Oct 2026): a 12 October update naming the company whose access was abused, its owner and passwords used on its accounts has been removed until we can link a readable primary source for it.