Denmark population registry data breach

What happened

Denmark's Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals. The breach is reported to have involved the misuse of legitimate access and possibly brute-forcing, with threat actors obtaining names, addresses, CPR numbers, and other information relating to registered members, as stated:

AI summary of accepted evidence. Check the original sources for the full context.

Reported impact

Attack method

misuse of legitimate access

Attack method

brute-forcing

Read the original reporting and statements. Multiple articles may rely on the same underlying source.

BleepingComputer01

Denmark population registry data breach affects 8.8 million people

Retrieved 3 Nov 2026

Denmark's Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals.

Attributed reporting

2 more excerpts

threat actors misused a private Danish company's legitimate access to the registry system to obtain names, addresses, CPR numbers, and other information relating to registered members.

Attributed reporting

the attack involved some form of brute-forcing to enumerate valid CPR numbers, and then extract the related data from each entry.

Attributed reporting