By Hamza Faisal
Hackers broke into Denmark's national population registry and obtained the personal data of around 8.8 million people, the Danish digital affairs ministry announced on Monday, calling it "an extremely serious incident."
The unauthorized individuals gained access to names, addresses and CPR numbers — Denmark's equivalent of social security numbers — of people registered in the Central Person Register, including those who have died or emigrated from the country.
The breach occurred after unidentified individuals misused the legitimate system access of a private Danish company authorized to search the registry. The company's access has since been blocked while police investigate.
The administration first detected irregular activity on October 2 and determined over the weekend that unauthorized searches had taken place during September. The hackers have not yet been identified.

A cornerstone of Denmark's digital society

The CPR system is a cornerstone of Denmark's highly digitized public sector. Every resident is assigned a unique 10-digit CPR number, which is widely used to identify individuals when dealing with government agencies, banks and healthcare providers.
While Denmark has a population of around six million, the national registry holds records on roughly 11 million people. People registered in the system for name and address protection were not exposed, the ministry said.
"This is an extremely serious incident," Digitalisation Minister Christina Egelund said in a statement. She has ordered a comprehensive security review of the CPR system and urged Danes to be vigilant about suspicious calls and emails.

How the attackers got in

Instead of attacking the registry directly, the intruders appear to have piggybacked on a private company's legitimate access, abusing search privileges the firm was entitled to use.
It is too early to determine who was behind the breach, authorities said. The administration is working with the police and other authorities to map out the full extent of the incident.
The method echoes a broader pattern in which attackers target trusted third parties with privileged access rather than hardened government systems themselves — an approach that can turn a single company's account into a skeleton key for national-scale data.

What happens next

With the ministry still mapping the breach's full extent, residents are being advised to treat unexpected calls, emails or messages asking for personal details with suspicion, as stolen identity data can fuel phishing and fraud for years.
The incident lands just days after another high-profile Danish breach — the cyberattack on the Danish Technical University that may have exposed 200,000 users — raising fresh questions about the resilience of the country's public digital infrastructure.
A comprehensive security review of the CPR system is now underway. What it recommends — and whether the government rethinks third-party access to one of the country's most sensitive databases — could reshape how Denmark guards the digital identity of its citizens.
By Hamza Faisal