An unusually high bill exposed Denmark’s CPR data breach
Tuesday 6th October 2026 on 14:15 in
Denmark
DR has learned that an unusually high bill for searches of Denmark’s civil registration system led authorities to discover the country’s largest-ever CPR data breach. The bill was issued to a small company at the end of September.
Companies with lawful access to the register are charged for each search. The total on the company’s September bill was high enough to raise the alarm. DR has not been able to establish the amount.
On the evening of Friday, October 2, the CPR Administration became aware of irregular activity in the system during September, according to a statement from the Ministry of Research, Education and Digitalisation. Over the weekend, it learned that unauthorised users had accessed names, addresses and CPR numbers belonging to about 8.8 million people, including living people, people who had emigrated and deceased people.
The unauthorised access lasted 10 days. The data was obtained by misusing a small Danish company’s legitimate access to the register.
Jacob Herbst, chair of the Cyber Security Council, called the way the breach was discovered “quite shocking”. He said he would have expected more systematic monitoring, and that it seemed too random for a billing employee to uncover a breach of this scale. He added that the system should detect large data downloads, including when they are made by a small company.
Several experts have criticised the security protecting the CPR system. Digital investigator Jan Kaastrup of cybersecurity company CSIS said several aspects were in urgent need of replacement. He also pointed to the fact that a person’s CPR number cannot be changed if it is leaked, comparing it to having one password for life that works across many systems.
Prime Minister Mette Frederiksen said on Tuesday that the incident “should not be able to happen” and expected the responsible authorities to pursue all relevant leads and take the necessary steps. Digitalisation Minister Christina Egelund said on Monday that there was “clearly” a weakness in the CPR system’s security.