Denmark CPR System Breach Exposes Personal Records of 8.8 Million People

A massive unauthorized data harvesting campaign targeting the Denmark national ID system breach has exposed the personal records of approximately 8.8 million individuals. Over a 10-day period in September, threat actors leveraged compromised access credentials belonging to an authorized third-party business entity to query the Central Person Register (CPR) database, conducting millions of automated lookups before the activity was detected.

The breach affects living residents of Denmark, individuals who have moved abroad, and deceased citizens whose records remain in the system. Individuals who had previously registered for protected names and addresses were excluded from the exposed datasets.

Third-Party Credential Misuse and Data Harvesting

The incident represents a classic business partner credential compromise and automated data scraping campaign. The attackers did not exploit a software vulnerability or deploy zero-day malware against the registry infrastructure itself. Instead, they acquired valid credentials assigned to a private company with legitimate access rights to the CPR system.

Once inside, the actors initiated automated queries at scale. Administrators discovered the breach on October 2 after observing abnormal query volumes linked to the compromised company account. Subsequent investigation revealed that the attackers submitted over 14 million individual database queries across roughly 10 days in September, with approximately 8.8 million returning valid citizen records.

This attack pattern succeeds because third-party API integrations often enjoy elevated trust within enterprise and government environments. When an authorized account lacks rigorous velocity limits, query throttling, or anomaly detection tailored to behavioral baselines (such as off-hours access or unprecedented query volume), attackers can systematically exhaust or enumerate backend databases without triggering traditional endpoint defense mechanisms.

Impact on National Identity Infrastructure

The CPR number is a 10-digit national identification code assigned at birth or immigration to anyone residing in Denmark. It functions as the primary key across healthcare, taxation, banking, telecommunications, and municipal services.

Because the query volume exceeded 14 million attempts and returned 8.8 million positive records—a figure larger than Denmark’s total living population of roughly 5.9 million—the exposed dataset likely represents an near-exhaustive archive of modern CPR records spanning decades.

While a CPR number alone is legally classified as sensitive personal data rather than a secret password, many commercial organizations and legacy workflows have historically treated possession of a CPR number and matching personal details as sufficient proof of identity. The exposure of these records dramatically heightens the risk of:

• Targeted Social Engineering: Threat actors can use full legal names, historical address histories, and valid CPR numbers to craft highly convincing pretexting attacks against victims via phone, email, or SMS.
• Identity Theft and Fraud: Fraudsters can attempt account takeovers, fraudulent credit applications, or unauthorized service sign-ups across private institutions that fail to enforce strong authentication checks.
• Cross-Referencing and Profiling: Combining this dataset with previous commercial leaks allows malicious actors to build comprehensive profiles on targeted individuals for spear-phishing campaigns.

Strategic Shift Away from CPR Authentication

The affected third-party organization has been disconnected from the CPR database, and Denmark’s National Special Crime Unit is conducting a criminal investigation. However, because data harvesting attacks cannot be “rolled back” once completed, official response efforts are focusing on structural authentication changes across the public and private sectors.

Danish authorities are strongly advising all organizations to cease using CPR numbers as standalone proof of identity. Instead, entities relying on identity verification are being instructed to integrate stronger cryptographic identity frameworks:

• Mandatory MitID Adoption: Organizations must migrate verification flows to MitID, Denmark’s national digital identity solution. MitID enforces hardware-bound or app-based multi-factor authentication (MFA) and cryptographic challenge-response mechanisms, rendering stolen CPR numbers useless for account access or transaction signing.
• Out-of-Band Verification: Systems unable to implement full MitID workflows immediately are required to implement step-up mechanisms, such as two-factor authentication (2FA) or time-based one-time passwords (TOTP), to validate identity during sensitive transactions.

For API owners managing broad citizen registry integrations, mitigating third-party supply chain risks requires implementing strict rate-limiting per account, mandatory IP pinning or mutual TLS (mTLS) for system-to-system accounts, and real-time behavioral alerting on query volume anomalies.