Data Leak – CPR Administration (Central Person Register)

In September 2026, unauthorized parties abused a Danish private company's legitimate access to CPR lookups. The Datatilsynet described a large number of automated lookups used to identify valid CPR numbers. The Ministry of Higher Education and Science estimated that approximately 8.8 million registered people were affected, including people who had emigrated or died. According to the ministry, people with name and address protection were not affected. The company's identity and the actors responsible have not been disclosed. The date above is when the CPR administration became aware of the irregular activity, not the confirmed start of access.

• Ministry of Higher Education and Science — Omfattende uautoriseret adgang til borgeres CPR-oplysninger
• Datatilsynet — Datatilsynet er opmærksom på sag om opslag i CPR