--- title: "Denmark CPR registry unauthorized access" description: "Denmark disclosed unauthorized CPR lookups affecting approximately 8.8 million registered persons, including deceased and emigrated people." incident_type: "Data incident" status: "active" last_modified: "2026-10-13" canonical_url: "https://www.ally.security/incidents/denmark-cpr-unauthorized-lookup-2026" markdown_url: "https://www.ally.security/incidents/denmark-cpr-unauthorized-lookup-2026.md" stix_url: "https://www.ally.security/incidents/denmark-cpr-unauthorized-lookup-2026/stix.json" --- # Denmark CPR registry unauthorized access Attackers abused a company’s legitimate registry access; the government stopped that access and began an investigation. Last modified Oct 13, 2026 · 3 sources ## Summary - **Environment:** Danish CPR registry accessed through a private company - **Operational impact:** Company lookup access stopped - **Financial impact:** No incident cost established in the reviewed evidence ## What happened Denmark’s [CPR administration](https://www.cpr.dk/) disclosed unauthorized access to registry information through an unnamed company’s lawful lookup access. The [government notice](https://fudm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger/) describes irregular activity during September, detected October 2. [3](#source-3) ## Impact Approximately 8.8 million registered persons were affected, including living, emigrated and deceased people. The figure is not a count of living Danish residents. [3](#source-3) The [CPR notice](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger) identifies names, addresses and CPR identifiers, while excluding protected registrants’ names and addresses. [2](#source-2) ## Timeline ### October 2, 2026 — Irregular activity detected The administration became aware of September lookup anomalies. [3](#source-3) ### October 5, 2026 — Public disclosure Authorities disclosed unauthorized access. [3](#source-3) ### October 7, 2026 — Policy discussions announced The minister [convened political parties](https://mssb.dk/nyheder/nyhedsarkiv/2026/oktober/minister-indkalder-partier-til-at-droefte-sag-om-kompromittering-af-cpr-registret/) to discuss possible responses. [1](#source-1) ### October 13, 2026 — Briefing updated This briefing was last reviewed and updated on October 13, 2026. ## Threat Group & Attack Vector The reviewed notices establish abuse of authorized company access but do not identify the company or explain how the attacker obtained that access. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Authorities stopped the company’s access, notified the data-protection regulator and began a police investigation and security review. [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Minister convenes parties to discuss compromise of the CPR register official · Danish Ministry of Resilience and Preparedness · Oct 7, 2026 ### CPR administration notice — unauthorized access to CPR information official · CPR administration · Oct 5, 2026 ### Ministry notice — unauthorized access to CPR information official · Danish Ministry of Research, Education and Digitalisation · Oct 5, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Denmark CPR registry unauthorized access: Irregular access detected 2. **Resulted In · 100% confidence · current** Denmark CPR registry unauthorized access: Policy discussions announced 3. **Resulted In · 100% confidence · current** Denmark CPR registry unauthorized access: An unauthorized party abused an unnamed Danish company’s legitimate CPR lookup access to obtain registered persons’ names, addresses and CPR identifiers. 4. **Occurred At · 100% confidence · current** Public disclosure: 2026-10-05 5. **Resulted In · 100% confidence · current** Denmark CPR registry unauthorized access: The government said protected registrants’ names and addresses were excluded from unauthorized access; this does not establish that every field for those people was excluded. 6. **Resulted In · 100% confidence · current** Irregular access detected: CPR administration became aware of irregular September lookup activity. 7. **Affected Individual Count · 100% confidence · current** Denmark CPR registry unauthorized access: 8,800,000 individual 8. **Discovered At · 100% confidence · current** Denmark CPR registry unauthorized access: 2026-10-02 9. **Affected Organization · 100% confidence · current** Denmark CPR registry unauthorized access: CPR administration 10. **Resulted In · 100% confidence · current** Denmark CPR registry unauthorized access: Public disclosure 11. **Resulted In · 100% confidence · current** Policy discussions announced: The preparedness minister convened political parties to discuss possible policy responses. 12. **Occurred At · 100% confidence · current** Policy discussions announced: 2026-10-07 13. **Occurred At · 100% confidence · current** Irregular access detected: 2026-10-02 14. **Resulted In · 100% confidence · current** Public disclosure: The ministry and CPR administration disclosed the unauthorized access. 15. **Resulted In · 100% confidence · current** Denmark CPR registry unauthorized access: CPR administration stopped the company’s access and notified the data-protection authority; police investigated and the ministry ordered a security review.