Data breach at Denmark’s national population register exposes 8.8 million people

What happened

The perpetrators exploited an unnamed domestic company’s legitimate access to Denmark’s Central Person Register (CPR) to compromise names, addresses and CPR numbers — roughly comparable to Social Security numbers in the U.S. She added that she had ordered a broad security review of the system, and that the country’s hotline for digital security will be operating at extended hours, from 8 a.m.

Officials said they first detected irregular activity affecting the CPR system on Friday. Denmark is investigating a data breach (an incident in which data leaves an organisation without permission) affecting approximately 8.8 million people after unauthorized users gained access to its national population register.

In total, the register holds information on around 11 million people, including current residents, people who have moved abroad and those who are deceased. Denmark’s current population is just over six million.

“This is a deeply serious incident,” Christina Egelund, the minister for research, education and digitalisation, said in a statement . Investigations over the weekend determined that the breach occurred during September, they said, although they did not comment on who the perpetrators may be.