Denmark's Entire Population Registry Scraped Through a Single Company Account
The personal details of 8.8 million people held in Denmark's national population register were accessed without authorisation in September, the country's digitalization ministry confirmed on October 5. That figure covers living residents, people who've emigrated, and the dead. The register holds about 11 million records in total, meaning roughly four in five entries were hit.
The attackers didn't need to break into government infrastructure. They went through a small Danish company that already held legitimate access to the Central Person Register (CPR). Someone apparently compromised that company's account and spent around ten days running automated lookups against the register to harvest valid CPR numbers. An employee spotted the unusual activity on October 2. By the weekend, officials had a rough sense of the scale.
How it happened in the first place is the part nobody's explaining clearly yet. Private companies are legally permitted to query the CPR for records on people they already deal with, such as customers or employees. Nobody has publicly addressed how one small company's access credentials ended up being used to sweep across records for the near-entirety of the Danish population. Minister Christina Egelund told the Ritzau news agency that the safeguards around this type of access had not been solid enough, and acknowledged that something should have triggered an alarm far sooner.
A CPR number is a ten-digit identifier: six digits for date of birth, four serial digits. That means at most 10,000 possible combinations exist per birth date. Whether the attackers were brute-forcing those combinations or working from some other list isn't confirmed in any official statement.
What wasn't exposed, at least in theory: names and addresses belonging to people registered under name-and-address protection, a status that blocks private entities from seeing those details. Whether their CPR numbers were reached anyway is something the ministry hasn't addressed.
Police are investigating. Denmark's data protection authority, Datatilsynet, received notification from the register on October 4 and is now examining what happened, how it was possible, and who bears responsibility. The register itself has cut off the company's access.
As for what affected people should actually do: the ministry is directing everyone to set up a credit warning via borger.dk, which flags their CPR record to signal that lenders should take extra care before extending credit in their name. It doesn't block lending outright, and newly registered warnings can take a few days to propagate through company systems, but it's the most practical immediate step available. Anyone 15 or older can set one.
The ministry is also doing the usual: don't share MitID credentials or one-time codes with anyone, don't click links in unexpected messages, and be suspicious of anyone who calls knowing personal details about you. That last point matters here, since CPR numbers combined with names and addresses are exactly the kind of data that makes phishing calls sound convincing.
Whether people will be individually notified hasn't been decided. Whether some will need new CPR numbers also remains open. The act does allow for replacement numbers in cases of proven misuse, but Egelund told Ritzau it was too early to say if that would apply here.
The ministry has started unspecified measures to prevent a repeat and requested a full security review of the register. Given that the access ran for ten days before anyone noticed, a review seems like the bare minimum.