Key takeaways
- 8.8 million people were affected after unauthorized individuals abused a private company’s legitimate access to Denmark’s Central Person Register.
- Names, addresses, and CPR numbers were exposed, increasing the risk of phishing, social engineering, impersonation, and identity fraud.
- Legitimate access can become a security risk when compromised, making data minimization an important layer of defense.
- Sensitive data discovery helps reduce breach impact by identifying unnecessary PII and protecting information that must be retained.
Massive Data Breach
On October 5, 2026, the Danish government disclosed a major data breach affecting its Central Person Register (CPR), with unauthorized individuals accessing the personal information of approximately 8.8 million people during September.
The exposed data includes names, addresses, and CPR numbers – Denmark’s unique personal identification numbers used across government services, healthcare, banking, taxation, and other essential systems.
Notably, the incident did not involve a direct compromise of the CPR system itself. Instead, attackers abused a private Danish company’s legitimate access to the register to extract the data through an authorized channel.
What Happened in the Denmark CPR Data Breach?
According to Denmark’s Ministry of Science, Higher Education and Digital Affairs, the CPR administration discovered irregular activity on October 2, 2026, related to unauthorized searches conducted throughout September.
Investigators found that unauthorized individuals had used a private company’s legitimate access to perform large-scale automated searches within the CPR system. The accessed information consisted of data available to private companies through authorized CPR searches, while individuals with name and address protection were not affected with respect to those protected details.
Following the discovery, the company’s access was immediately suspended, the incident was reported to Denmark’s Data Protection Agency, and Danish police launched an investigation. Authorities have not yet identified who was responsible.
Why This Breach Matters
A CPR number is a permanent 10-digit identifier. And while knowing a CPR number alone does not grant access to services protected by secondary authentication, combining it with a verified name and address makes phishing, social engineering, impersonation, and identity fraud significantly more convincing.
The incident also demonstrates how legitimate access can become a major security risk when abused. Credentials can be compromised, internal accounts can be misused, and trusted third-party vendors can become entry points.
When attackers gain access through authorized channels, the amount of sensitive information available internally can determine the ultimate impact of the breach.
Reducing At-Risk Data
Access controls remain essential, but incidents like the Denmark breach show that they cannot be the only line of defense. Organizations also need to understand what sensitive data they hold, where it's stored, and whether it should be there at all.
PII Tools discovers and classifies PII, PCI, PHI, and other sensitive information across enterprise environments, giving organizations the visibility needed to reduce unnecessary exposure and protect data that must be retained.
- Data Discovery and Minimization: Identify sensitive information across structured and unstructured data and remove unnecessary PII or redact, anonymize, encrypt, or quarantine it.
- AI Data Protector: Detect sensitive information before it enters AI applications and workflows, reducing the risk of PII being exposed to external models and services.
- AI Handwriting Recognition: Find PII hidden in handwritten forms, notes, annotations, and scanned paperwork that conventional OCR and text search may miss.
- 400+ File Formats: Discover sensitive data across PDFs, emails, images, archives, office documents, databases, and hundreds of other formats.
- 100% On-Premises Processing: Keep sensitive data within your own infrastructure without sending it to third-party cloud services for processing.
The CPR register is designed to contain personal information, but in most enterprise environments, large amounts of PII are duplicated, retained unnecessarily, or stored where they no longer need to be.
The less sensitive data you store unnecessarily, the less there is to compromise when security controls fail.
Discover Where Your Sensitive Data is Living & How PII Tools Can Help You Protect It!
Frequently Asked Questions (FAQ)
How many people were affected by the Denmark CPR data breach?
Approximately 8.8 million people were affected, including current residents, people who have moved abroad, and deceased individuals.
What data was exposed in the Denmark CPR breach?
The exposed data included names, addresses, CPR numbers, and other information that private companies could access through authorized CPR searches.
How did the Denmark CPR data breach happen?
Unauthorized individuals abused a private Danish company’s legitimate access to run large-scale automated searches in the CPR system in September 2026.
What is a Danish CPR number?
A CPR number is a permanent 10-digit personal identification number used in Denmark for interactions with government agencies, healthcare providers, banks, tax authorities, and other services.
How can organizations reduce the impact of data breaches?
Organizations can reduce their exposure by discovering where sensitive data is stored, removing PII they no longer need, and protecting necessary data through measures such as redaction, anonymization, encryption, and access controls.
What is PII Tools?
PII Tools is sensitive data discovery software, so you can discover, analyze, and remediate PII across all your digital assets, on-premises or in your Private Cloud. Schedule a FREE DEMO and secure your PII for good!
