Misused Company Access Exposed CPR Data on About 8.8 Million People in Denmark
1A Company's Legitimate Access Exposed Data on Most of Denmark's Register
During September, unauthorized parties misused one Danish company's legitimate access to the national population register and obtained access to the names, addresses and personal identification numbers of about 8.8 million registered people. Denmark calls it the CPR, short for Det Centrale Personregister. It holds the name, address and personal identification number, the CPR number, of everyone registered, including people who died or emigrated. More than 1,000 companies may look people up in it, from banks and insurers to law firms and trade unions. The Ministry of Research, Education and Digitalization announced the incident on October 5, 2026. On October 9 the register's administration wrote to the 1,039 companies with access. The letter leaves each company to decide which of its employees may use the register access it holds.
There is thus a very broad possibility for companies to gain access to the information listed in Section 38(2), including name and address if these are not protected ...
Christina Egelund, Minister of Research, Education and Digitalization, memo to the Danish parliament, October 9, 2026 (translated from Danish)
The register holds about 11 million people. The ministry says the misuse stayed within the information private companies may receive. It did not include the names and addresses of people registered with name and address protection. Under the CPR Act, a company may only request data on people it has already identified one by one, for example by CPR number or by name and address. The register's administration noticed irregular activity on the evening of October 2. It has stopped the company's access and reported the case to Datatilsynet, Denmark's data protection authority. Police are investigating. The ministry says it is not yet possible to say who is behind the misuse. It cautions that the facts may change as the mapping of events continues. The minister has asked for a thorough security review of the CPR system.
2The Letter Spells Out Duties Under Current Rules and Terms
The letter stresses duties that already apply under data protection rules and the register's current security terms. It lists six. Each company must have a security officer and take the technical and organizational measures needed so that only authorized access to CPR occurs. It may give CPR access only to employees who need it, the principle of least privilege. It must keep an ongoing check on its employees' access to CPR data. Every month it must track its number of CPR transactions to catch misuse. A public self-service website that triggers lookups must first sign users in with MitID, Denmark's national digital ID. The duties apply whether a company controls the data or processes it for another. A company that processes the data for others is asked to inform them.
In September, the FBI and CISA asked infrastructure operators to apply least privilege to their outside integrators. The CPR letter puts the same duty on the companies themselves, for their own staff.
Source: Ministry of Research, Education and Digitalization, memo on companies' access to CPR, with the CPR Administration's letter to companies, Folketing committee document ERU Alm.del Bilag 11, October 9, 2026.