Denmark Says Names and ID Numbers for 8.8 Million People Were Taken From Its Population Register

Denmark's Ministry of Research, Education and Digitalisation said on Oct. 5, 2026, that unauthorized parties had obtained the names, addresses and CPR numbers of about 8.8 million people listed in the Central Person Register, the national registry of people registered in Denmark. The CPR number is the personal identification number each of them is given.

The ministry said the access was obtained by misusing one private Danish company's lawful ability to search the register, within the fields that private companies are allowed to see. The register holds about 11 million records, a total that includes people who have died or moved abroad, so the ministry's figure covers most of the register. Records of people who have registered name and address protection were not included.

The ministry's statement says the CPR administration, which runs the register, became aware on the evening of Friday, Oct. 2, 2026, that there had been irregular behavior in the system during September. It established how many records had been reached over the following weekend. The company's access has been stopped. The case has been reported to Datatilsynet, Denmark's data protection authority, and the police are investigating it with other authorities.

Under Danish law, private companies with a legitimate interest can be supplied with register data on people they have already identified one by one. The ministry said the sequence of events is still being examined, and that the minister, Christina Egelund, has asked for a full security review of the CPR system.

The ministry also reminded the public not to give out passwords or other confidential information over the phone or by email, even when the caller appears to know a person's name, address and CPR number. It pointed to its sikkerdigital.dk guidance pages.