Summary
Statistics Denmark (Danmarks Statistik) has disclosed a breach of the Danish population registry affecting the personal data of approximately 8.8 million people — effectively the entire population of Denmark. The breach exposed names, addresses, and CPR numbers (the Danish national identification number equivalent) for all registered Danish residents. The Danish Data Protection Agency (Datatilsynet) has been notified. The breach of a national population registry containing CPR numbers represents one of the most comprehensive single-incident personal data exposures in European history.
Timeline
| Date | Event |
|---|---|
| October 2026 | Breach of Statistics Denmark population registry discovered; 8.8 million individuals affected |
| Oct 6, 2026 | Statistics Denmark discloses breach; notifies Datatilsynet; BleepingComputer reports |
What Happened
The Danish population registry (CPR-registret) is the authoritative national database of all Danish residents, maintained by Statistics Denmark. It contains the CPR number — a unique ten-digit personal identifier assigned at birth or upon registration as a Danish resident — along with current address, name, and demographic information. The CPR number functions as the master key to Danish public and private services: it is used for tax administration, healthcare, banking, social services, and identity verification across virtually every sector of Danish society.
A breach exposing CPR numbers for 8.8 million individuals creates a durable identity fraud risk that cannot be mitigated by password resets or account closures. Unlike passwords, CPR numbers are not rotated after a breach — they are permanent identifiers. The combination of name, address, and CPR number gives an attacker everything needed to impersonate a Danish resident across any service that relies on CPR-based identity verification. The scale of exposure — the entire Danish population — means there is no unaffected cohort to serve as a control; every Danish resident must be treated as potentially exposed.
Domain Intelligence
dst.dk — 58.1
dst.dk scores in the low-trust range at 58.1. Statistics Denmark is the operator of the breached population registry. The T5_NO_CORPUS_HITS flag indicates limited corpus-layer coverage for this Danish government domain.