Denmark’s Central Person Register Breached, Exposing 8 Million People’s Records

Denmark’s government has confirmed that hackers stole data on approximately 8 million citizens and residents from its Central Person Register (CPR), in what is believed to be the largest data breach in the country’s history. The breach occurred in September 2026 and was discovered on October 2, 2026.

The stolen data includes names, addresses, Danish social security numbers, and other information stored in the CPR — the government’s central database used to manage citizens’ identity numbers for tax payments and access to public services. Although Denmark’s current population is around 6 million, the CPR holds records on approximately 11 million people, with some data stretching back decades. Those affected include people living abroad and the deceased.

Danish minister Christina Egelund described the breach as a “serious incident.” The government said attackers gained unauthorized access by “abusing a Danish company’s lawful access to search for information in the CPR system,” referring to the practice of allowing certain private companies to verify individuals’ information against the government database. Authorities have not publicly identified who is responsible for the attack.

The breach follows a pattern of cyberattacks targeting national identity databases in other countries, including a 2016 breach affecting millions of Turkish citizens and multiple exposures of data from India’s national Aadhaar database.

The scale of the incident is significant given the sensitivity of the data involved. Danish social security numbers are used to access a wide range of government services, meaning the exposure of this information could potentially affect individuals’ ability to securely interact with public institutions.