--- title: Danish population register breach exposes about 8.8... description: Denmark's Central Population Register suffered what officials call the country's largest-ever data breach, exposing roughly 8.8 million records including... canonical: https://daily.dev/posts/danish-population-register-breach-exposes-about-8-8-million-records-xfv7urepy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Danish population register breach exposes about 8.8 million records | daily.dev og:description: Denmark's Central Population Register suffered what officials call the country's largest-ever data breach, exposing roughly 8.8 million records including... og:url: https://daily.dev/posts/danish-population-register-breach-exposes-about-8-8-million-records-xfv7urepy og:image: https://api.daily.dev/og/posts/XFV7uREPY.png og:image:alt: Danish population register breach exposes about 8.8 million records og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Danish population register breach exposes about 8.8 million records **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary Denmark's Central Population Register suffered what officials call the country's largest-ever data breach, exposing roughly 8.8 million records including names, addresses, and Danish ID numbers. A private company with legitimate access to the registry had its credentials abused to extract the data in September; the irregular activity was detected October 2 and the company's access was blocked. Police and the Danish Data Protection Agency are investigating. The incident has reopened debate over whether CPR numbers should still function as secret identifiers given how widely they're queried, with a cybersecurity specialist arguing the numbers were never truly secret. Denmark joins Turkey and India among countries that have had national ID databases leaked. ## Content Someone abused a private company's legitimate access to Denmark's Central Person Register (CPR) and pulled personal data on about 8.8 million people. That is the biggest data breach in Danish history, according to reports. The haul includes names, addresses and CPR ID numbers, among other details. The number is larger than you might expect for a country of roughly six million. The register also holds deceased people and those who have moved abroad, and it contains around 11 million records in total, so the attackers got most of it. ## What happened The attacker got in on September 10 and ran about 14 million automated searches through September 20. Of those, 8.8 million returned actual records. Nobody noticed for more than three weeks. On October 2, a staffer at the CPR administration spotted an unusually large bill for queries from one company, and that led to the discovery. The CPR administration traced the activity to the firm's account and blocked its access. It notified the Danish Data Protection Agency on October 4, and the breach was disclosed the next day. Police, including the National Special Crime Unit, are investigating. No suspects have been identified. ## The password A hacker has claimed the way in was an account protected by the password "123456." Politiken reported that the company, Funen-based Pays ApS, had at least three accounts using that same weak password, including an administrator account. Pays had legitimate CPR access to validate customer records. The hacker's claim is not an official finding. But if the Politiken report is right, this was not a sophisticated intrusion. It was an unlocked door. ## What officials are saying Authorities warn that the exposed CPR numbers could be used for fraud and identity theft. Their advice is to stop treating a bare CPR number as proof of identity. Civil security agency head Laila Reenberg is among the officials saying so. Organizations should use MitID, two-factor authentication or one-time codes instead. The minister for digitalisation has ordered a security review of the CPR system, with no deadline set. Officials have not decided whether to reissue everyone's CPR number. A cybersecurity specialist argued that treating these numbers as secret identifiers is a broken security model to begin with. I think that last point is the real story. The number was never meant to be a password, but for decades institutions behaved as if it were. A weak password at one vendor just made that visible. Reissuing 8.8 million numbers would be a huge job, and it would not fix the habit of trusting them. ## Questions this post answers ### How did attackers get access to Denmark's Central Population Register data breach in September? Attackers abused a private company's legitimate, authorized access to the CPR register rather than breaking in externally. The extraction occurred in September, covering roughly 8.8 million records including names, addresses, and Danish ID numbers. The CPR administration detected irregular activity on October 2, traced it back a month, and revoked the company's access, with police now investigating. _Following how trusted third-party access gets abused in breaches like this one is easy to track on daily.dev._ ## Similar posts on daily.dev - [Danish university DTU breach exposes data of up to 200,000 people](https://daily.dev/posts/danish-university-dtu-breach-exposes-data-of-up-to-200-000-people-l2s8cnaej) · BleepingComputer · 2 upvotes · 0 comments - [15.8M medical records stolen from French health ministry](https://daily.dev/posts/15-8m-medical-records-stolen-from-french-health-ministry-wf933jtn2) · The Register · 0 upvotes · 0 comments - [1.2 Million Bank Accounts Exposed in Financial Systems Breach](https://daily.dev/posts/1-2-million-bank-accounts-exposed-in-financial-systems-breach-flccsxygb) · Security Boulevard · 0 upvotes · 0 comments - [Another massive data breach exposed millions of driver’s license numbers](https://daily.dev/posts/another-massive-data-breach-exposed-millions-of-driver-s-license-numbers-z6spff7ie) · TechCrunch · 0 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/danish-population-register-breach-exposes-about-8-8-million-records-xfv7urepy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Danish population register breach exposes about 8.8 million records","url":"https://daily.dev/posts/danish-population-register-breach-exposes-about-8-8-million-records-xfv7urepy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/danish-population-register-breach-exposes-about-8-8-million-records-xfv7urepy"},"datePublished":"2026-10-06T11:53:56.602Z","dateModified":"2026-10-13T11:21:24.682Z","description":"Denmark's Central Population Register suffered what officials call the country's largest-ever data breach, exposing roughly 8.8 million records including...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/42479c961a37db44bf25484182cfa1c6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/42479c961a37db44bf25484182cfa1c6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/danish-population-register-breach-exposes-about-8-8-million-records-xfv7urepy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Danish population register breach exposes about 8.8 million records"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/danish-population-register-breach-exposes-about-8-8-million-records-xfv7urepy#faq","mainEntity":[{"@type":"Question","name":"How did attackers get access to Denmark's Central Population Register data breach in September?","acceptedAnswer":{"@type":"Answer","text":"Attackers abused a private company's legitimate, authorized access to the CPR register rather than breaking in externally. The extraction occurred in September, covering roughly 8.8 million records including names, addresses, and Danish ID numbers. The CPR administration detected irregular activity on October 2, traced it back a month, and revoked the company's access, with police now investigating. Following how trusted third-party access gets abused in breaches like this one is easy to track on daily.dev."}}]} ```