Denmark Central Person Register (CPR) Data Breach
Denmark's Ministry of Higher Education, Research and Digitalisation disclosed on October 5, 2026, that the nation's civil registration system, the Central Person Register (Det Centrale Personregister, CPR), suffered a major data breach affecting approximately 8,800,000 individuals.
Exposed Data Types
3- Names
- Physical addresses
- Government issued IDs
About This Breach
Rather than compromising the core registry infrastructure directly, threat actors hijacked legitimate access credentials belonging to an authorized private Danish company and executed automated queries throughout September 2026 before the anomaly was detected on October 2.
The harvested records cover roughly 80 percent of the entire national register, encompassing living residents, emigrants, and deceased individuals. Exposed fields included full names, residential addresses, and 10-digit Danish CPR national identification numbers, prompting authorities to revoke the compromised vendor's access and launch a national police investigation.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
