Denmark: massive data leak from the central population register

An entire country in a single file. The Danish government announced this Monday, October 5, 2026 that unknown persons have obtained the names, addresses and identification numbers of nearly 8.8 million people registered in the central population register. No system was forced, since the intruders passed through the legal access of a private company. French readers have known the music since the hacking of the FICOBA file, which exposed 1.2 million bank accounts.

CPR register: 8.8 million cards vacuumed without break-in

Friday, October 2 evening, the CPR administration noticed irregular behavior in its system. It dates back to September. The weekend was enough to measure the damage.

According to the ministry's press release, third parties have hijacked a Danish company's access to query the register. They thus consulted the names, addresses and CPR numbers of around 8.8 million registrants. The figure exceeds the population of the kingdom, which has around 6 million inhabitants, because the register also keeps people who have died and those who have gone to live abroad.

The CPR is the ten-digit number assigned to each resident since 1968. It serves as an entry key to the bank, the doctor or taxes. The system now has around 11 million records, which means that four out of five have been consulted. Only people placed under name and address protection are exempt.

Misused legal access, the weak point of the national identifier in the face of data leaks

No one broke a lock. Danish law allows private companies with a legitimate interest to obtain information about people they have already identified, and the intruders stayed within that scope. The administration cut off access to the company concerned, seized Datatilsynet, the Danish equivalent of the CNIL, and the police are investigating.

Christina Egelund, Minister of Research, Education and Digital, speaks of a “profoundly serious incident”. She informed the relevant parliamentary committee and ordered a thorough security review of the system. The authors remain unknown. The ministry also warns that the figures may still change as the investigation progresses.

Let's be fair, the press release does not mention any password or banking information, even if its list ends with an "etc." ". The danger is elsewhere. Copenhagen reminds you to never communicate a code by telephone or e-mail, even when the interlocutor knows your name, address and CPR number. A helpline remains open from 8 a.m. to midnight for the next few days.

Centralized digital identity: why crypto holders should watch Copenhagen

You change a password in two minutes. A CPR number follows a Dane all his life. Once removed from the register, it cannot be revoked, and the scammer who calls while reciting it immediately gains the trust of his victim.

For those who hold bitcoin, the subject is concrete. A private key kept in self-custody, that is to say by its owner and without an intermediary, does not appear in any State file. Your postal address, yes. However, Europe is moving in the same direction as Denmark, since the eIDAS 2 regulation requires each member state to offer a digital identity wallet by the end of 2026.