The Denmark CPR data breach exposed names, addresses and personal identification numbers for about 8.8 million people, and nobody broke through a firewall to get them. Danish authorities said on October 5, 2026 that unknown parties misused a Danish company’s legitimate access to the Central Person Register during September, querying it at scale. The records taken cover roughly 80% of the register.
For a small business, the lesson is uncomfortable: the riskiest login in your environment may belong to a supplier, and it will look normal right up until someone checks the volume.
| What happened | Attackers misused a single firm’s authorized login to the Central Person Register (CPR), Denmark’s population register, and pulled personal records |
| Who’s affected | About 8.8 million people, including residents, emigrants and deceased persons; people with name and address protection were not affected |
| Severity | High: Danes need their CPR number for healthcare, banking and dealings with government |
| Status | The company’s access has been blocked; police are investigating; perpetrators unattributed |
| What to do now | Audit third-party access, add volume alerts and rate limits, warn staff about well-informed phishing calls |
What happened in the Denmark CPR data breach
The CPR administration’s notice says unauthorized parties obtained names, addresses, CPR numbers and other details by misusing a Danish firm’s lawful search access to the register. The administration cut off that firm’s access, reported the case to the Danish Data Protection Agency (Datatilsynet) and opened a police investigation.
The Ministry of Research, Education and Digitalisation says the irregular activity was spotted on the evening of Friday, October 2, 2026. Investigators spent the weekend establishing that the access had taken place in September, and the data protection agency was notified on Sunday, October 4, The Record reports.
The register holds roughly 11 million people, far more than Denmark’s population of just over six million, because it keeps entries for people who have moved abroad or died. Minister Christina Egelund has ordered a broad security review and extended the national digital security hotline to run from 8 a.m. to midnight. Egelund told the news agency Ritzau, as reported by The Copenhagen Post, that security around the firm’s access had “not been good enough.” The company involved has not been named, and officials have not said who was behind the searches.
How the attack works
This was not a software exploit. According to BleepingComputer and The Record, the data protection agency described a very large number of automated searches aimed at finding valid CPR numbers, then pulling the record behind each hit.
That pattern is plausible because a CPR number is partly predictable: the 10-digit number begins with the holder’s date of birth. In our analysis, that leaves a search space small enough to work through with a script, if a query interface puts no meaningful cap on lookups.
Officials have not disclosed how the attackers got hold of the company’s access. Whatever the route, the searches arrived through access the register had granted on purpose.
Why it matters for small businesses
Most small firms don’t run national registries, but almost all of them hand out the same kind of trust. Your accountant has a login to your bookkeeping platform. An MSP holds admin rights in Microsoft 365. A marketing agency can export your customer list from the CRM. Each of those accounts may be able to read data in bulk, and in our experience few small businesses watch how much any one of them reads.
There is a second-order risk for anyone who does business in Denmark. A dataset that ties names to addresses and identity numbers is ideal raw material for convincing phone and email fraud. The Danish authorities’ own guidance, relayed by BleepingComputer, is to never hand over passwords or confidential information to a caller or sender, even one who already knows your personal details. Finance teams handling Danish suppliers or customers should expect payment-change requests that sound very well informed.
On regulation: in the EU, Article 33 of the GDPR requires a controller to notify its supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. If you are the controller, a breach that runs through a supplier’s access is still your notification to make; a supplier acting as your processor must tell you without undue delay.
What to do now
- List every third party with access to your systems this week: MSPs, accountants, agencies, integrations and API keys. Remove anything nobody can justify.
- Scope each supplier account to the records and actions it needs. A bookkeeper rarely needs export rights to your full customer list.
- Turn on alerts for unusual volume. Check whether your Microsoft 365, Google Workspace or CRM plan can alert on mass downloads or exports, and route those alerts to someone who reads them.
- Rate-limit any lookup or search feature you expose, including customer portals and internal APIs, so one account can’t walk your whole database.
- Require MFA on every supplier account and review sign-in logs for logins from new countries or odd hours. Our guide to password managers for small teams covers how to share supplier credentials without emailing them around.
- Brief staff on callback verification: any payment change or credential request gets confirmed through a number you already hold, not one the caller provides.
For a wider planning list, see 7 cyber threats every small business should plan for.
Oreaxe’s take
In our view, the most telling detail is the detection gap. The access took place in September, and the irregular activity wasn’t noticed until October 2. Egelund herself said warnings should have been triggered sooner, according to The Copenhagen Post.
We see the same blind spot in small firms all the time. Owners spend effort on keeping strangers out and almost none on what trusted accounts do once they’re in. The Fakturownia invoicing breach we covered on October 4 was another reminder that your data lives in other people’s systems too.
If we had to pick one control to add this month, it would be a volume alert on supplier accounts. Depending on your plan, it may already be included or may need a higher license tier, and it is the kind of alarm designed to catch this pattern early.
Sources
- CPR-kontoret (CPR administration), “Omfattende uautoriseret adgang til borgeres CPR-oplysninger,” October 5, 2026: cpr.dk
- Ministry of Research, Education and Digitalisation, press release, October 5, 2026: ufm.dk
- The Record, “Data breach at Denmark’s national population register exposes 8.8 million people,” October 5, 2026: therecord.media
- BleepingComputer, “Denmark population registry data breach affects 8.8 million people,” October 5, 2026: bleepingcomputer.com
- The Copenhagen Post, “Danish minister says security was inadequate after access to 8.8 million personal records,” October 5, 2026: cphpost.dk
- EUR-Lex, Regulation (EU) 2016/679 (GDPR), Article 33: eur-lex.europa.eu
Every factual claim links to its source. Spotted an error? Tell us.