denmark-cpr-2026 · Disclosed 2026-10-05
Denmark CPR: unauthorized retrieval through legitimate company access
Legitimate company lookup access was abused to retrieve data on about 8.8 million registered people, including deceased and emigrated people; the access-acquisition mechanism remains under investigation.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
Authorities reported third-party abuse of a private company’s legitimate CPR lookup access.
- Reported fact
About 8.8 million registered people include deceased and emigrated people; protected names and addresses were excluded.
- Reported fact
The regulator received an October 4 notification and is investigating bulk automated searches for valid CPR numbers.
[s3]通知と調査状況
Timeline
Reported response
- Reported fact
Stopped the company’s access and began investigation and security review.
- Reported fact
Immigration service desks added identity checks for telephone inquiries.
[s4]Ekstra kontrol ved telefoniske henvendelser
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Insufficient evidence
Inspect lookup privileges, retrieval limits, logs and identity checks; undisclosed entry and prior controls prevent an avoidability assessment.
Editorial assessment; not a determination of liability. [s1][s3]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
Credential theft or software exploitation is not established; occurrence timing and final scope remain under investigation.
Sources
[s1] デンマーク研究・教育・デジタル化省 · Primary source
Omfattende uautoriseret adgang til borgeres CPR-oplysninger ↗Published 2026-10-05 · Reviewed 2026-10-12
[s2] CPR管理者 · Primary source
Omfattende uautoriseret adgang til borgeres CPR-oplysninger ↗Published 2026-10-05 · Reviewed 2026-10-12
[s3] Datatilsynet · Primary source
Datatilsynet er opmærksom på sag om opslag i CPR ↗Published 2026-10-05 · Reviewed 2026-10-12
[s4] Udlændingestyrelsen / SIRI · Primary source
Uvedkommende har fået adgang til borgeres CPR-oplysninger ↗Published 2026-10-05 · Reviewed 2026-10-12