The Danish government disclosed a significant data breach involving its Central Person Register (CPR), which contains personal information on approximately 8 million individuals. This affected group surpasses Denmark’s current population of 6 million because the database includes residents abroad and historical records dating back decades. The stolen data includes names, addresses, social security numbers, and other vital personal information used for taxation and public services.

Minister Christina Egelund described the incident as a “serious” breach. It was uncovered on October 2, 2026, though the unauthorized access had occurred in September. Authorities revealed that the hackers exploited legitimate access held by a Danish company to penetrate the CPR system. This company had lawful rights to query the database for identity verification purposes, which were misused in the attack.

Danish officials have not publicly identified those responsible for the breach. However, this incident appears to be the largest cyberattack on a government database in Denmark’s history. It draws parallels to similar major national ID system breaches, such as the 2016 hack of Turkey’s citizen database and multiple exposures involving India’s Aadhaar program.

This extensive breach raises concerns about the protection of sensitive citizen data in government systems worldwide. It underscores the risks posed by insider threats and misuse of authorized access to highly sensitive databases. The Danish government is now likely to intensify security measures around access controls and monitoring within its critical public services infrastructure.