Denmark’s Population Register Breach Exposes the Risks of Europe’s Digital State

Denmark is investigating one of the largest breaches of personal data in its history after unauthorised users gained access to information on around 8.8 million people through the country’s Central Person Register (CPR). The compromised data includes names, addresses and CPR numbers, which function as permanent personal identifiers used across Denmark’s healthcare, banking and public administration systems. The incident was disclosed on October 5 after authorities detected unusual activity in the system in September.

A trusted connection became the entry point

The breach does not appear to have resulted from a direct compromise of the CPR infrastructure itself. Instead, the attackers exploited a Danish private company’s legitimate access to the population register and used that connection to conduct a very large number of automated searches. Denmark’s Data Protection Agency said the activity was aimed at identifying valid CPR numbers and confirmed that it received a formal notification about the incident on October 4.

The distinction is important. Denmark’s highly digitalised public sector relies on allowing private companies and institutions to access state databases for legitimate purposes. Under Danish law, companies with a justified interest can obtain information from the CPR within defined limits. The breach demonstrates how such access can become a systemic vulnerability if a legitimate account or connection is compromised.

The CPR contains information on roughly 11 million registered people, including current residents, people who have emigrated and deceased individuals. The 8.8 million figure therefore exceeds Denmark’s current population of slightly more than six million. People who had specifically requested protected names and addresses were not included in the affected data, according to the authorities.

The long tail of permanent identifiers

The most serious aspect of the incident is not simply the number of records involved but the nature of the information exposed. Unlike a password, a Danish CPR number is intended to remain associated with an individual for life. Its combination with names and addresses creates a potentially durable basis for identity fraud, targeted phishing and social engineering.

Danish authorities have consequently warned citizens to be particularly cautious about calls, emails and other communications that appear to contain accurate personal information. Knowing someone's name, address and CPR number can make fraudulent communications significantly more convincing, even when attackers do not have access to financial accounts or passwords.

The authorities have not identified who was behind the operation. The investigation is being conducted by police together with relevant agencies, while the Data Protection Agency is examining how the data was processed and who bears responsibility. Officials have stressed that the investigation remains at an early stage and that the currently known details may change as the technical investigation progresses.

A structural problem for Europe’s digital model

For Denmark, the breach is also a test of the security assumptions behind one of Europe's most advanced digital states. The country's public administration depends on interconnected databases that allow citizens to use a small number of digital identifiers across healthcare, taxation, banking and government services.

That architecture creates enormous efficiency gains, but it also concentrates risk. When a single identifier can connect large parts of an individual's relationship with the state, the consequences of a compromise extend well beyond the database where the breach originated. The Danish case illustrates a broader European dilemma: digitalising public services can make government more efficient while simultaneously increasing the potential impact of a single security failure.

The problem is particularly relevant as European governments expand digital identity systems and integrate public and private-sector infrastructure. The EU's NIS2 framework is designed to strengthen cybersecurity and resilience across critical sectors and public authorities, with additional requirements for security measures, incident reporting and supervision.

Denmark's experience suggests that protecting such systems requires more than securing government servers. The security perimeter increasingly includes private companies, contractors and other organisations with legitimate access to state infrastructure. A weak point in that wider ecosystem can provide an attacker with access that bypasses many of the controls surrounding the central government system.

Denmark moves to review the system

The Danish government has ordered a comprehensive security review of the CPR and has already suspended the affected company's access while authorities map the full sequence of events. The government has also extended the opening hours of its digital-security hotline as the investigation continues.

The incident is the most significant security event involving the CPR since 2015, when physical CDs containing information on more than five million people were mistakenly delivered to the Chinese Visa Application Centre in Copenhagen. The latest case is fundamentally different: rather than an accidental transfer of data, it involves the exploitation of a legitimate digital access mechanism on a much larger scale.