Four out of five people in Denmark's national register, among them many who have died or left the country, now have their name, address and personal identity number in the hands of someone who should never have seen them. Denmark's research, education and digitalisation ministry said on October 5 that intruders had copied data on about 8.8 million people from the Central Population Register, known as CPR, by misusing the legitimate access that a private company held to the system.
The CPR number is the key to Danish life, a ten digit identifier used for tax, healthcare, banking and almost every dealing with the state, and unlike a password it is not something a person can simply change. The register holds about 11 million records in all, covering current residents along with people who have emigrated or died, so the copied set amounts to roughly 80 percent of everything in it.
A legitimate door, used by the wrong hands
The route in was not a hack of the register itself. Danish companies with a legitimate need, such as confirming a customer's address, can be granted the right to query the CPR system under section 38 of the CPR Act, provided they identify each person in advance by personal number, by name and date of birth, or by name and address. According to the ministry, the intruders used one company's access of that kind and stayed within the categories of data such companies are allowed to see. The CPR administration has since cut the company off.
Datatilsynet, the Danish data protection authority, added a detail the ministry left out. The notification it received from the CPR administration on Sunday October 4 describes a very large number of automated lookups against the system aimed at identifying valid CPR numbers. In other words, the access was used to enumerate the register at scale rather than to look up particular people. The agency says it is now examining what happened, how it was possible and who bears responsibility for the processing involved.
Found on a Friday evening, sized over the weekend
The timeline the ministry has published is short. Late on Friday October 2, the CPR administration noticed that something irregular had happened in the system at some point in September. By the end of the weekend it knew the scale: names, addresses and CPR numbers of about 8.8 million registered people had been accessed. It notified Datatilsynet on October 4 and the ministry went public the following day, after minister Christina Egelund had briefed the parliamentary committee that oversees business and digitalisation. The police are investigating together with other authorities, and the ministry says the inquiry is at an early stage and that it cannot yet say who is behind it.
One group was spared the worst. The ministry says the review so far shows that names and addresses belonging to people registered with name and address protection did not appear in the data accessed, though it has not said whether anything else about them did. Nor has it said whether other fields the register can hold, such as marital status, family relationships or church membership, were taken in every case.
What happens to 8.8 million numbers now
The immediate concern is fraud. The ministry warns that criminals who know a person's name, address and CPR number can make a convincing phone call or email, and it reminds everyone not to give out passwords or any other confidential details in response to a call or message, however much the caller appears to know. The government's cyber hotline has extended its opening hours for the coming days, and official guidance is being published on the state's digital security website.
The harder question is structural. Egelund has ordered a full security review covering the whole CPR system and says measures have already been put in place to prevent a repeat, though the ministry has not described them. Asked whether affected citizens should be issued new CPR numbers, she said after briefing lawmakers that it was too early to decide, and that what the review found would decide which changes are needed before people can trust the register again. Investigators, she added, have not ruled out any possibility, including involvement from abroad.
For a country that built its digital public sector on a single identifier shared with tax offices, banks and clinics, the breach lands on the design itself. A CPR number was never meant to be secret in the way a password is, but it was never meant to sit in a file of 8.8 million either. The security review will have to answer whether the problem was one company's access, or the assumption that a lookup service holding 11 million records can safely be opened to private firms at all.
