Unauthorized access to Denmark's Central Person Register
On October 5, 2026, Denmark's CPR Administration said unauthorized parties misused a Danish company's legitimate access and obtained names, addresses, CPR numbers, and other data for about 8.8 million people in the national register.
What was reported
The CPR Administration's notice, published October 5, 2026, says unauthorized parties misused a Danish company's legal access to search the Central Person Register. They obtained names, addresses, CPR numbers, and other data on about 8.8 million registered people. The notice says the unauthorized access did not include names and addresses of people who had registered for name and address protection.
The administration says it has stopped that company's access, reported the incident to the Data Protection Agency, and that police are investigating with other authorities. The notice is in Danish. The company is not named here. The official notice describes it only as a Danish company, and this feed does not add a name.
How to prevent it
Keep a list of outside organizations that can read personal data, and be ready to turn that access off. The notice says the administration stopped the company's access after the misuse. It does not say how the access was misused, so this note does not add a cause.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.