Pull to refresh
Logo
What Changed
Following Why Sign Up
Denmark data breach exposes personal data of millions of citizens

Denmark data breach exposes personal data of millions of citizens

Force in Play

Attackers used a leaked password ('123456') to pull names, addresses, and CPR numbers of 8.8 million people from Denmark's national registry over a 21-day window.

October 18th, 2026: Hacker offers to help Denmark in exchange for immunity

Overview

Updated Oct 18

An anonymous suspected hacker told Danish newspaper Politiken that the program used to steal 8.7 million CPR numbers was written by artificial intelligence. The program, containing more than 40,000 characters, was reviewed by two experts who concluded the code was AI-generated, Politiken reported.

The suspected hacker, who denied having advanced technical skills, said they obtained login details from a leaked password ("123456") belonging to a former employee of Pays ApS, the company whose legitimate access was abused. The hacker has offered to help Denmark strengthen its IT security if police guarantee not to prosecute. Danish authorities are investigating and pursuing a full security review of the CPR system.

Why it matters

If the stolen data feeds fraud campaigns, millions of Danes face targeted phishing and identity scams using their real names, addresses, and CPR numbers.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

~970,000
Danes who set up credit warnings
Credit warnings on Borger.dk surged from about 250,000 on October 1 to almost 970,000 within a week of the leak being announced.
14M+
CPR queries made with stolen access
More than 14 million attempted queries were run through the company's account, far exceeding any plausible business need.
21 days
Unauthorized access window
Access ran from September 10 to October 2 (21 days 17 hours), with active queries appearing to end September 20.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Christina Egelund
Christina Egelund
Minister for Research, Education and Digitalisation
Overseeing the government's response to the breach

Organizations Involved

CP
Central Person Register (CPR)
Government database
Breached registry

Denmark's national population register, holding records on about 11 million people including citizens, residents, the deceased, and those who have emigrated.
Datatilsynet (Norway's Data Protection Authority)
Datatilsynet (Norway's Data Protection Authority)
Data protection authority
Investigating the breach

Denmark's independent data protection authority, which opened a case into the breach.
DR
Danish police (Rigspolitiet)
Law enforcement
Investigating the breach

Investigating the breach with access to the CPR security log, which records which companies made searches.

Timeline

September 2026 October 2026

12 events Latest: October 18th, 2026 · 3 weeks ago Showing 8 of 12
Tap a bar to jump to that date

  1. Hacker offers to help Denmark in exchange for immunity

    Latest Investigation

    The alleged hacker sent an encrypted message to Politiken offering to help Denmark strengthen its IT security, on condition that Danish police guarantee not to prosecute.

  2. Suspected hacker says AI created attack program

    Investigation

    The anonymous suspected hacker told Politiken that artificial intelligence created the computer program used in the attack. Two experts reviewed the code (over 40,000 characters) and concluded it was AI-generated.

  3. Data breach affects 8.8 million people, says ministry

    Government

    The Danish Ministry of Research, Education and Digitalisation published a press release detailing the unauthorized access to CPR registrations, confirming the breach affected approximately 8.8 million registered persons.

  4. Hacker claims password '123456' was used

    Investigation

    An anonymous hacker told Politiken they logged in with a former employee's leaked password, 123456. The claim has not been officially confirmed by authorities.

  5. Credit warnings surge to nearly one million

    Public Response

    Almost 970,000 Danes registered credit warnings on Borger.dk within a week of the leak being announced, up from about 250,000 on October 1. The warnings flag that extra identity checks are needed before credit is issued.

  6. Authorities reveal 21-day access window

    Investigation

    Documents obtained by TV2 show unauthorized access lasted from September 10 to October 2 (21 days 17 hours), with active queries appearing to end September 20, about 10 days after they began.

  7. Credit warnings quadruple to ~970,000

    Public Response

    Almost 970,000 Danes registered credit warnings on Borger.dk by October 7, up from about 250,000 on October 1.

  8. Denmark defers decision on new CPR numbers

    Government

    Digitalisation Minister Christina Egelund told parliament it was too early to decide whether the 8.8 million affected people would need new CPR numbers. A security review of the entire CPR system is underway.

  9. Ministry announces breach affecting 8.8 million people

    Announcement

    Minister Christina Egelund announced the breach, called it deeply serious, and requested a full security review.

  10. CPR administration notifies Datatilsynet

    Notification

    Over the weekend the administration learned the extent of the access and notified the data protection agency.

  11. CPR administration notices unusual activity

    Discovery

    An employee noticed irregular activity on Friday evening; the company's access was cut off. The unusually large invoice for searches flagged the problem.

  12. Unauthorized access to CPR system begins

    Incident

    Attackers abused a small Danish company's lawful access to search the CPR register, lasting about 10 days.

Scenarios

1

Police identify and charge those behind the CPR breach

Possible Resolves by Apr 5, 2027

Discussed by: Danish police and Datatilsynet, which are investigating with access to the CPR security log

The security log records which companies made searches, and the breach was precisely pinpointed to a 10-day window in September. Police have prior experience with similar cases, including a 2025 case where an intern sold registry details to a gang. An arrest or formal charges would confirm the attackers' identity and motive.

2

Stolen CPR data fuels a documented fraud campaign

Possible Resolves by Apr 5, 2027

Discussed by: Danish authorities, who warn the data could be used for targeted phishing

The ministry warns that stolen names, addresses, and CPR numbers could be used in fraud attempts. Scammers could use the real data to make fake calls, texts, or emails sound genuine - for example, a fake bank call claiming an account is at risk. A documented campaign would show the data's real-world impact.

3

Security review leads to CPR system reforms

Likely Resolves by Apr 5, 2027

Discussed by: Minister Christina Egelund, who requested a full security review

Egelund has asked for a thorough security review of the CPR system and said measures are already underway to prevent a repeat. The review could lead to new security requirements for companies with registry access, or legislative changes to the CPR Act. The ministry has not detailed the measures already begun.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

2016

Turkey national ID breach (2016)

A breach exposed records of millions of Turkish citizens, including national ID numbers, addresses, and other personal data. The data was reportedly offered for sale online.

Then

The Turkish government downplayed the breach while the data circulated online.

Now

It became a reference point for the scale of damage a national identity database breach can cause.

Why this matters now

Like Denmark's CPR, Turkey's national ID database held permanent, hard-to-revoke identity data that became a high-value target for fraud.

2017-present

India Aadhaar database exposures (2017-present)

India's Aadhaar national ID database, holding biometric and personal data on over a billion people, has faced repeated data exposure incidents since 2017, including leaked access portals and data sold on messaging apps.

Then

Each exposure triggered investigations and promises of tighter security.

Now

The repeated incidents showed that national identity systems become permanent targets because the data cannot be changed or revoked.

Why this matters now

Aadhaar's repeated exposures illustrate why a breach of Denmark's CPR register is so serious - the stolen identity data remains valid and usable for years.

Sources

(29)
+23
TechCrunch Deutsche Welle AFP The Hacker News The Irish Times The Local Denmark Help Net Security The Straits Times SCY Scan Techlantis CPR.dk Bytes Europe DR The Copenhagen Post The Copenhagen Post GovInfoSecurity Politiken Conscia CSIS Security Group Forsknings-, Uddannelses- og Digitaliseringsministeriet NRC The Register The Copenhagen Post The Copenhagen Post The Copenhagen Post Politiken The Copenhagen Post Politiken Politiken