Summary
- Environment: Danish CPR registry accessed through a private company
- Operational impact: Company lookup access stopped
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 13, 2026; updated as evidence emerges.
What happened
Denmark’s CPR administration disclosed unauthorized access to registry information through an unnamed company’s lawful lookup access. The government notice describes irregular activity during September, detected October 2. [3]
Impact
Approximately 8.8 million registered persons were affected, including living, emigrated and deceased people. The figure is not a count of living Danish residents. [3] The CPR notice identifies names, addresses and CPR identifiers, while excluding protected registrants’ names and addresses. [2]
Timeline
Irregular activity detected
The administration became aware of September lookup anomalies.
[3]Public disclosure
Authorities disclosed unauthorized access.
[3]Policy discussions announced
The minister convened political parties to discuss possible responses.
[1]Briefing updated
This briefing was last reviewed and updated on October 13, 2026.
Threat Group & Attack Vector
The reviewed notices establish abuse of authorized company access but do not identify the company or explain how the attacker obtained that access. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Authorities stopped the company’s access, notified the data-protection regulator and began a police investigation and security review. [3]