# Denmark CPR data breach and new security mandates > Live situation record from CLSTR: https://clstr.news/situations/denmark-central-person-register-data-breach > Updated: 2026-10-17T16:19:52.000Z. Sources: 91. Developments: 6. A major data breach within Denmark’s Central Person Register (CPR) has exposed the personal information of approximately 8.75 to 8.8 million records. The compromised data includes names, addresses, and personal identification numbers for 5.5 million living individuals and 3.3 million deceased persons. The total number of records exceeds the country’s population as it includes deceased individuals and residents living abroad. Investigations have confirmed the breach occurred via a supply chain attack on the Odense-based IT company Pays ApS, which held legal access to the registry. The unauthorized access lasted from September 10 until it was shut down in early October. During this period, an attacker reportedly performed roughly 14 million automated searches using two custom programs, one of which an attacker claimed was written using an AI model. The breach was discovered on October 2 after a ministry staffer noticed an unusually high invoice, as each query incurs a cost. Sophie Laursen, director of Pays ApS, confirmed the company's account was the one compromised. The intrusion was facilitated by severe security failures, including the use of extremely weak passwords such as ‘123456’ on at least three accounts, including one with administrator privileges. Initial access was gained via credentials leaked from a former employee. While individuals with name and address protection were not affected, others face increased risks of fraudulent communications. The perpetrator reportedly told the newspaper Politiken that they had ‘no intention of selling or leaking the stolen information.’ In response, Digital Affairs Minister Christina Egelund has issued strict security mandates to 1,039 companies with CPR access, requiring them to appoint security officers and monitor transaction volumes. Dansk Industri (DI) has advised businesses to transition toward more secure methods like MitID. As of early October, approximately 970,000 people had registered credit warnings to mitigate identity theft risks. ## Claims - Approximately 970,000 people in the CPR register had created a credit warning as of Wednesday at 18:00. (disputed by 3 sources) - Around 250,000 people were registered with a credit warning on October 1. (disputed by 3 sources) - The attacker used the weak password ‘123456’ to gain access. (corroborated by 16 sources) - The data breach affected approximately 8.8 million people in Denmark. (corroborated by 14 sources) - The leaked information contains names, addresses, and Central Person Register (CPR) numbers. (corroborated by 11 sources) - The breach targeted the Danish Central Person Register (CPR). (corroborated by 11 sources) - The person claiming responsibility stated they had no intention to sell or publish the stolen data. (corroborated by 9 sources) ## Timeline ### 2026-10-17: Denmark data breach exposes 8.8 million identities via weak password A cybersecurity breach in Denmark exposed the personal data of 8.8 million people after an attacker used the weak password ‘123456’ to access the national civil registration system via an IT firm. 3 sources. https://clstr.news/cluster/denmark-data-breach-exposes-88-million-identities-via-weak-password ### 2026-10-15: Denmark data breach exposes 8.8 million citizens' records A cyberattack on Denmark's Central Person Register exposed the data of 8.8 million people after an attacker used the weak password ‘123456’ to access an account at IT firm Pays ApS. 7 sources. https://clstr.news/cluster/denmark-national-population-register-data-breach-affects-88-million-people ### 2026-10-13: Denmark CPR registry breach exposes data of 8.8 million people A cyberattack on Danish IT firm Pays ApS exposed the personal data of 8.8 million people in the national CPR registry, allegedly using the weak password ‘123456’ to gain unauthorized access. 18 sources. https://clstr.news/cluster/pays-aps-data-breach-exposes-88-million-danish-cpr-numbers ### 2026-10-10: Denmark CPR breach exposes 8.8 million records via Pays ApS A data breach via IT firm Pays ApS has exposed the CPR information of 8.8 million people in Denmark, facilitated by weak passwords like '123456'. Authorities have issued new security mandates to over 1,000 much 3 sources. https://clstr.news/cluster/denmark-issues-security-mandates-following-88-million-cpr-data-breach ### 2026-10-07: Denmark Central Person Register suffers massive 8.8 million record data breach A massive data breach in Denmark's Central Person Register has exposed the personal information of approximately 8.8 million people, prompting nearly one million citizens to register credit warnings. 8 sources. https://clstr.news/cluster/denmark-cyberattack-leaks-88-million-citizen-records ### 2026-10-05: Denmark CPR register breach exposes data of 8.8 million people A major data breach in Denmark's Central Person Register has exposed the names, addresses, and CPR numbers of approximately 8.8 million people, including deceased and emigrated individuals. 58 sources. https://clstr.news/cluster/denmark-cpr-system-breach-compromises-88-million-records --- Cite as: Denmark CPR data breach and new security mandates. CLSTR, https://clstr.news/situations/denmark-central-person-register-data-breach