[REVISION HISTORY]

Denmark CPR data breach and new security mandates

Updated 10 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-17 16:16 UTC → 2026-10-17 22:43 UTC · added ~~removed~~

A major data breach within Denmark’s Central Person Register (CPR) has exposed the personal information of approximately 8.75 to 8.8 million records. The compromised data includes names, addresses, and personal identification numbers for 5.5 million living individuals and 3.3 million deceased persons. The total number of records exceeds the country’s population as it includes deceased individuals and residents living abroad. Investigations have confirmed the breach occurred via a supply chain attack on the Odense-based IT company Pays ApS, which held legal access to the registry. The unauthorized access lasted from September 10 until it was shut down in early October. During this period, an attacker reportedly performed roughly 14 million automated searches using two custom programs, one of which an attacker claimed was written using an AI model. The breach was discovered on October 2 after a ministry staffer noticed an unusually high invoice, as each query incurs a cost. Sophie Laursen, director of Pays ApS, confirmed the company's account was the one compromised. The intrusion was facilitated by severe security failures, including the use of extremely weak passwords such as ‘123456’ on at least three accounts, including one with administrator privileges. Initial access was gained via credentials leaked from a former employee. While individuals with name and address protection were not affected, others face increased risks of fraudulent communications. The perpetrator reportedly told the newspaper Politiken that they had ‘no intention of selling or leaking the stolen information.’ In response, Digital Affairs Minister Christina Egelund has issued strict security mandates to 1,039 companies with CPR access, requiring them to appoint security officers and monitor transaction volumes. Dansk Industri (DI) has advised businesses to transition toward more secure methods like MitID. As of early October, approximately 970,000 people had registered credit warnings to mitigate identity theft risks.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.