Automated Queries Turn Trusted Connection Into Nationwide Privacy Incident
Denmark is investigating a major security incident after unauthorized actors obtained personal information associated with approximately 8.8 million people from the country's Central Person Register (CPR).
The exposed information includes names, addresses and CPR identification numbers belonging to current residents, people who have emigrated and deceased individuals.
The attackers did not directly break through the CPR system's perimeter. Instead, they abused the legitimate registry access of an unnamed private Danish company—turning a trusted connection into a channel for mass data collection.
Automated Searches Exploited Legitimate Access
Denmark's Data Protection Agency said the incident involved an exceptionally large volume of automated CPR queries intended to identify valid identification numbers.
Third-Party Access Became the Attack Path
Danish companies with legitimate business requirements can receive restricted access to CPR information under national data-protection rules.
Attackers exploited one company's authorized connection to retrieve information available to private organizations.
The company's CPR access has since been terminated.
8.8 Million Records Were Exposed
The figure exceeds Denmark's current population of roughly six million because the CPR database contains around 11 million registered individuals, including former residents and deceased people.
Protected Addresses Were Excluded
Authorities said their investigation currently indicates that names and addresses belonging to people registered for name-and-address protection were not exposed through the unauthorized activity.
The final scope remains under investigation.
Suspicious Activity Continued During September
CPR administrators detected irregular behavior on the evening of October 2.
Investigators subsequently determined that unauthorized access had occurred during September.
The incident was reported to Denmark's Data Protection Agency, while police and other authorities have opened investigations. No attacker or threat group has yet been publicly identified.
CPR Data Creates Long-Term Fraud Risk
A CPR number is a persistent Danish personal identifier used across government, healthcare, banking and other services.
Stolen Identity Data Strengthens Social Engineering
The immediate danger is not necessarily that a CPR number alone gives attackers access to an account.
The greater threat comes from combining a real name, physical address and valid personal identifier to make phishing calls, emails and fraudulent identity-verification attempts substantially more convincing.
Danish authorities have specifically warned citizens not to disclose passwords or confidential information simply because a caller or message already knows their personal details.
Breach Exposes a Third-Party Trust Problem
The incident demonstrates a critical weakness in highly centralized identity systems: security depends not only on protecting the central database, but also on controlling every organization authorized to query it.
Legitimate Access Still Requires Behavioral Controls
Sensitive registries need safeguards capable of identifying abnormal query velocity, automated enumeration, unusual lookup patterns and sudden changes in customer behavior—even when requests arrive through valid credentials.
Denmark has ordered a broader security review of the CPR system and says additional measures are already being introduced.
The larger lesson extends beyond Denmark: when millions of identities sit behind trusted third-party connections, legitimate access can become the attack surface itself.