Danish CPR: 8.8 million records via a company’s access

A few days ago we covered the unauthorised access to Denmark’s central population register, the CPR, and the authorities’ advice on identity checks. We now also know how the access happened: whoever was behind it did not break into the system, but used the legitimate access of a private Danish company authorised to query the register. According to the outlets following the case, more than 14 million searches were made, returning data on about 8.8 million people.

For security teams, the case is about one specific issue: control over the access granted to suppliers and partners.

What happened

The statement from the Danish ministry responsible for digitalisation, dated 5 October 2026, says the CPR administration noticed irregular activity on 2 October and established the scale of the access over the weekend. The searches took place in September: according to CSO Online, they went on for about 10 days.

The exposed data listed by the ministry are names, addresses and CPR numbers. The number of people affected exceeds Denmark’s population of around 6 million because the register holds about 11 million records, including people who have died or moved abroad. The CPR also includes more than 55,000 people living in Greenland, who use their CPR number for healthcare, tax and banking. The ministry notes that the names and addresses of people with address protection were not exposed.

The company, which has not been named, has had its access blocked. The Danish data protection authority has been notified and the police are investigating: CSO Online names the National Special Crime Unit. Those responsible have not been identified, and a broader security review of the CPR system is under way.

Technical details: legitimate access used out of proportion

The key point is in the ministry’s statement: the unauthorised persons used a private company’s legal access to search the CPR within the scope of the data that private companies are allowed to see. In other words, the searches did not exceed the account’s permissions: it was their volume that was anomalous.

Private companies can receive CPR data under the Danish Civil Registration System Act and the ministry’s access terms. As The Register reports, those terms state that access concerns a group of people defined and identified individually in advance, and that recipients must be entitled to process the data under the GDPR. The sources do not explain how a single account could run millions of searches; The Register has asked the ministry for clarification.

Based on what is known so far, the pattern falls under two MITRE ATT&CK techniques: Valid Accounts (T1078), the use of valid credentials or access, and Trusted Relationship (T1199), entry through a third party with legitimate access. There are no CVEs and no public indicators of compromise.

What remains unclear

The sources do not say how the company’s access was obtained. The Register speaks of abuse of legitimate access, CSO Online of access credentials exploited by unauthorised parties: none of them says whether stolen credentials, a compromised account or insider abuse was involved. Digitalisation minister Christina Egelund described the company as “small” and said it was too early to decide whether to issue new CPR numbers, one of the solutions proposed.

Impact for European and Italian companies

The case highlights a risk for every organisation: a supplier with access to a sensitive system can become the way in without bypassing any technical control, because the access is legitimate. This applies to large public registers as much as to company ERPs, CRMs and data platforms opened up to partners, consultants and integrators.

For NIS2 entities, supply chain security and access control are among the risk management measures required by the directive. In healthcare, where suppliers often access patient data, the issue is even more sensitive.

Then there is the downstream effect, already covered in our first article: stolen personal data can be used for fraud and to bypass weak identity checks. The Danish authorities advise against relying on the CPR number alone and recommend MitID, two-factor authentication or one-time codes. In Italy the same applies to name, address and tax code: they are not secrets.

What to do now

1. Inventory third-party access: which suppliers and partners access which systems and data, with which accounts and from which addresses.
2. Limit access to what is needed: for each supplier, define which data they can see and, where possible, on which people or cases, as the CPR terms in theory require.
3. Set volume limits: apply rate thresholds to queries and APIs, and block or flag accounts that exceed them.
4. Know what normal looks like: record how many searches each external account usually makes and review spikes, out-of-hours searches and sequential queries.
5. Strengthen authentication: multi-factor authentication, short sessions and dedicated credentials for each of the supplier’s users, not shared accounts.
6. Review suppliers over time, not only at contract start, and include in your incident response plan how to quickly revoke external access.

How ARXDOME helps

ARX Sentry collects logs and events from servers and firewalls and, in the SOC identity pages, shows logins, privileged access, night-time logins and bursts of attempts: useful data for keeping an eye on accounts used by suppliers and partners. ARX Retain keeps logs for the years required, so that in an investigation you can reconstruct what an account did and when.

Last updated: 7 October 2026