Policy & Regulation
Hackers steal records of some 8 million people from Danish database
Denmark's government confirmed hackers stole data on some 8 million citizens and residents from its Central Person Register (CPR), by abusing a company's lawful access to the system.
The Danish government has confirmed that hackers breached its Central Person Register (CPR), the central database holding citizens’ personal data, and stole most of its contents. The breach affects some 8 million citizens and residents of Denmark, including people living abroad and the deceased.
Danish minister Christina Egelund called the breach a “serious incident” that let hackers steal names, addresses, Danish social security numbers and other information. The CPR holds the government-issued identity numbers Danish citizens use to pay tax and access other services. Denmark’s current population is about 6 million people, but the database includes records on about 11 million people, with some data going back decades.
The government would not say who is behind the breach, which happened in September but wasn’t discovered until October 2. It said the unauthorized access was obtained by abusing a Danish company’s lawful access to search for information in the CPR system — some companies in Denmark hold that access specifically to verify people’s information with the government.
The breach is thought to be the biggest in Denmark’s history. It follows a string of similar attacks on government national-identity databases elsewhere, including a 2016 breach that affected millions of Turkish citizens and repeated exposures of national ID data from India’s Aadhaar database.
Why it matters
The breach underscores how national identity registries — built to simplify tax and public-service access — concentrate enough sensitive personal data to make them high-value, high-damage targets once a single trusted third party’s access is compromised.