A cyberattack disclosed in 2026 exposed 8.8 million records from Denmark's Central Person Register (CPR) after attackers entered through a compromised company account, Rescana reports.

The volume exceeds Denmark's resident population of roughly 5.9 million. The dataset therefore contains historical entries, former residents, or duplicate identity records attached to the 10-digit CPR number assigned at birth or immigration.

What is the Central Person Register?

The CPR has assigned personal identification numbers to every Danish resident since 1968. The register connects to nearly every government system and most regulated private-sector databases in the country, including banks, insurers, healthcare providers, and telecom operators.

How did one company account become the breach point?

Use of a single corporate credential indicates the attackers did not penetrate CPR core infrastructure directly. They exploited third-party query access, the kind routinely granted to vendors, auditors, or partner agencies for permitted lookups. A phished or stolen service account bypasses perimeter defences and leaves the central database uncompromised in technical terms while still enabling bulk extraction.

What is the scale of exposure?

At 8.8 million records, the incident surpasses every previously reported Danish data breach. The figure represents roughly 150% of the country's current population. For comparison, the 2017 Equifax breach exposed 147 million US consumer records — about 45% of the US population at the time — and produced cumulative remediation costs above $1.4 billion.

What regulatory exposure follows?

Denmark operates under both the EU General Data Protection Regulation and the Danish Data Protection Act. A breach of this size triggers:

• Mandatory 72-hour notification to the Danish Data Protection Authority
• Potential administrative fines up to 4% of global annual turnover under GDPR Article 83
• Individual breach notification to data subjects where risk thresholds are met

Who runs the CPR?

Administrative responsibility sits with the Danish Ministry of Digital Affairs and the Agency for Digital Government. Neither ministry has issued a public technical post-mortem in the available Rescana reporting.

What should enterprise security teams review?

Any organisation using CPR numbers for customer identification, KYC, or service access must treat the identifier as potentially exposed. Priority controls include:

• Third-party access reviews for all register-query vendors
• Credential rotation policies for shared service accounts
• Anomaly detection on bulk CPR lookups
• Identity-theft monitoring for affected Danish residents
• Vendor risk reassessments for firms holding CPR integration

What remains unconfirmed?

The available reporting does not specify the intrusion date, the compromised company name, the duration of unauthorised access, or the specific fields extracted per record. These gaps prevent a full impact assessment for affected enterprises and residents.

Denmark's national identity infrastructure has not previously recorded a comparable compromise. The incident will drive a national-level review of third-party access governance across the public-sector data ecosystem, with banks and telecom carriers likely facing the earliest mandatory remediation deadlines.