Denmark’s population register: 8.8 million affected

Unauthorised users ran irregular searches of Denmark's population register through a private company that was allowed to use it. Officials still cannot say how much personal data those searches produced. The authorities estimate that 8.8 million people, out of roughly 11 million entries, were affected by the unauthorised access (Ministry, CPR Administration).

The register, known as the CPR, sits behind every Danish personal identity number. The estimate covers current residents, emigrants and the dead, and the details within reach included names, addresses and CPR numbers.

According to the ministry, the searches ran during September, and register staff spotted them on the evening of Friday 2 October. The company's access was cut, police opened an investigation, and Datatilsynet, Denmark's data-protection authority, was notified. Preliminary checks found that the names and addresses of people living under protected identities were not reached (Ministry).

How a licensed account became the way in

Private firms can get licensed access to the CPR for specified uses, mainly to keep customer records up to date. The company in this case held such a licence. Its name has not been published. Officials have not said who ran the searches: an employee, an outsider with stolen login details, or someone using another route.

The rules put much of the watching on the customer. CPR's standard terms from June 2026 require customers to log which employee ran each search and to review monthly usage statistics (CPR terms).

The register's own view can be narrower. Under the same terms, when a customer's software queries the CPR automatically, with no person typing each search, the register normally sees only the software making the request. Officials have not disclosed which arrangement this company used. The terms show where a blind spot could sit, not that one did. A ministerial estimate reported by Ritzau put the unnoticed activity at roughly ten days (DK Nyt/Ritzau).

Christina Egelund, the minister responsible, called the incident deeply serious and said security around the company's access had not been good enough. She ordered a review of all CPR access. Other private customers were reconnected on 5 October (CPR status), so the review runs while that kind of access stays open.

What officials have not yet established

The breach report Datatilsynet received on 4 October described a very large number of automated lookups designed to find valid CPR numbers (Datatilsynet). The regulator stressed that this was the notifier's account, not its own finding. Neither Datatilsynet nor the ministry has published how many lookups hit a real number, how many returned names or addresses, or how many records were copied.

Those missing figures drive two separate decisions. The first concerns warnings. Under the EU's General Data Protection Regulation, the organisation responsible for the data must tell people directly when a breach is likely to pose a high risk to their rights (GDPR). Datatilsynet supervises whether that judgment is made properly, and the judgment depends on what the lookups actually returned.

The second decision concerns new identity numbers, and it belongs to the government. After briefing two parliamentary committees, Egelund said it was too early to decide whether anyone should get a new CPR number (Ritzau). Renumbering is under discussion, not decided.

Why other Europeans should pay attention

Because the register includes emigrants, some of the people affected now live elsewhere in Europe, although no country breakdown has been published. Sweden has also seen an authorised connection exploited in a similar way. The trade union Vision says that in September and October 2025 a third party fed number-like sequences into its online membership form (Vision). Because the form automatically queried Sweden's state address register, it returned names and addresses for about 300,000 people (Sveriges Radio).

EU data-protection law requires appropriate security. It does not prescribe the login controls, search limits or per-user logs that a register's licensed customers must use (GDPR). Those choices sit with each register's operators, which is where Egelund's review now falls.

The record supports one firm conclusion. A permitted route into Denmark's population register was used without permission, at scale, before register staff caught it. Whether that became a large loss of personal data remains unproved. Datatilsynet and the police now need to establish how many lookups returned real names and addresses. What happened to that data afterwards is a separate question for the police investigation to answer.