Denmark's ID Register Breach Affects 8.8 Million People

Hackers stole personal records for about 8.8 million people from Denmark's Central Person Register (CPR), the Danish government confirmed on Monday, October 5, 2026.

Denmark's digital affairs ministry said hackers broke into the national registry and accessed personal information Channels TV. Early reporting put the total at about 8 million citizens and residents TechCrunch. The ministry later gave the more precise figure of 8.8 million affected individuals.

The CPR is Denmark's central citizens' database. It holds records on about 11 million people, while Denmark's current population is about 6 million. The gap reflects retention. The breach affects people living abroad and deceased persons as well as current residents.

Stolen data included names, addresses, Danish social security numbers and other information. The government described most of the register's contents as stolen. Minister Christina Egelund called the incident a "serious incident".

The intrusion occurred in September and was discovered on October 2. The government announced it three days later. Officials did not disclose who was behind the breach.

Access came through delegation, not direct compromise of the registry core. Unauthorized access was obtained by abusing a Danish company's lawful access to search the CPR system. The attackers did not need to defeat the registry's perimeter. They rode an authorized query path.

The broader context here is familiar to anyone who operates shared data systems. Central registers give search access to banks, insurers, healthcare providers, municipalities and other vetted entities. Each connection is a trust boundary, where security depends on the outside user as much as the center. If one login, one API key, a code that lets software connect, or one poorly separated client is compromised, bulk reads can look like normal traffic. It is like entering with a borrowed key rather than breaking a lock.

In my view, the timeline and scale point to the questions specialists will now ask. How queries were logged, and in what detail. Whether per-user rate limits, alerts for unusual volume, and purpose-based controls, rules limiting data by reason for use, were enforced. Whether one company login allowed sequential lookups across millions of CPR numbers. The verified facts do not answer those questions, but they narrow where the review will focus.

Looking at what this means for identity systems, the use of the Danish social security number both to identify people and to prove identity is the lasting problem. Names and addresses can change. A person number generally cannot, including for the deceased, whose records stay in the CPR. Once stolen at this scale, it stops working as a secret. It still works to link records. The number cannot be reissued. Protection must shift to downstream checks, stronger multi-factor authentication, asking for two or more proofs at login, and less use of fixed personal data for account recovery.

Worth flagging for operators of similar systems, this is also a data minimization test, a check on holding only needed data. An 11-million-record register for 6 million people carries added exposure. Keeping expatriate and deceased records may help administration and statistics. It also keeps data that cannot defend itself. Limited search rights, views showing only needed fields, and close audits of bulk access keep a necessary central system from large-scale disclosure.

Over the longer term, the case for central, well-managed digital identity remains strong. Centralization simplifies patching, logging and oversight. The task now is to make delegated access as robust as the core.