Unauthorized parties accessed names, addresses, and personal identification numbers (CPR numbers) of approximately 8.8 million people — around four in five of all records — in Denmark's national population register over roughly ten days in September 2025, exploiting a small private company's legitimate access to the system. An employee of the register's administration noticed the unusual automated lookups on 2 October, prompting authorities to revoke the company's access and refer the case to Denmark's data protection authority, Datatilsynet, while police launched an investigation. It remains unclear how the attackers gained access to the company's systems, whether they have retained or used the data, and whether affected individuals will be notified or issued new CPR numbers.
