8.8 million CPR numbers: the breach Denmark found on an invoice

Somebody spent ten days in September quietly pulling personal records out of Denmark's national civil register. Nobody noticed. Not the monitoring, not the logs, not the system operator.

What finally caught it was the bill.

Every time a company looks up a record in the CPR register, it pays a small fee. On Friday evening, 2 October, someone at the authorities was preparing the monthly invoice for a small Danish company and found a number that made no sense. As Mikkel Leihardt, a division chief at the Ministry of Research, Education and Digitalisation, put it at the press briefing: it was "a very, very large amount" — large enough to make someone stop and ask what this company had possibly been doing in September.

The answer: roughly 14 million lookup attempts, which returned data on about 8.8 million people. It is one of the largest data breaches in Danish history, and the control that detected it was the accounting department.

What actually happened

The CPR register is Denmark's Central Person Register. It holds a record for roughly 11 million people, including those who have died or emigrated. The CPR number itself is the key to everyday Danish life: healthcare, banking, tax, pharmacies, public services.

Private companies with a legitimate business need can be granted lawful access to look up records. One smaller Danish company had exactly that access. According to the ministry, unauthorised parties abused it.

Over about ten days in September, that access was used to attempt more than 14 million lookups. Not all CPR numbers exist, which is why the attempt count is higher than the population — a detail that tells you a lot, and we will come back to it. Around 8.8 million of those attempts returned real records.

Run the arithmetic and the scale becomes uncomfortable. 8.8 million records across ten days works out to roughly 880,000 per day, about 611 every minute, continuously, for a week and a half.

What was exposed

• Names, addresses and CPR numbers.
• Potentially also civil status, birth registration details, family relationships, citizenship, membership of the Church of Denmark, and any guardianship or legal-incapacity entries.
• The register covers living residents, people who have emigrated, and the deceased — which is why the figure exceeds Denmark's population.

One piece of good news: according to the review so far, the names and addresses of people registered with name and address protection were not exposed. The ministry has not specified exactly which additional fields were pulled for each individual.

The timeline

1. September 2026 — roughly ten days of sustained automated lookups through the company's legitimate access. Undetected.
2. Friday 2 October, evening — an unusually large invoice for CPR lookups triggers suspicion.
3. Saturday 3 October, evening — the National Unit for Special Crime (NSK) is physically at the company securing forensic evidence.
4. Sunday 4 October — the CPR administration notifies Datatilsynet, the Danish Data Protection Agency.
5. Monday 5 October — public announcement. The company's access is blocked. The minister briefs parliamentary committees.
6. Tuesday 6 October — second briefing. Authorities state publicly that a CPR number can no longer be used as sole identification.

Asked why more than two days passed between discovery and telling the public, the ministry said it had to stop the activity and involve the right authorities first. That is a defensible call. The more uncomfortable gap is the other one: the ten days where nothing flagged at all.

Which companies are involved — and the distinction that matters

Two different organisations are in this story, and conflating them is unfair to both.

The access-holder. A smaller Danish company whose lawful CPR lookup access was abused. It has not been named publicly. Police secured evidence at its premises, and the ministry has blocked its access. Importantly, nobody has been charged, and NSK has said it has no indication yet of who is behind it. Whether this company was itself a victim — compromised credentials, a stolen API key, a hijacked integration — or something else, is precisely what the investigation is for. It would be wrong to assume the worst about them today.

The operator. DXC Technology Denmark runs the CPR system itself. It won the operating contract in 2021 in a tender with only two bidders, worth around DKK 300 million over six years. Its lineage runs back to Datacentralen, founded in 1959 and publicly owned until CSC bought control in 1997. DXC also holds the keys to systems at the police, the tax authority and the state payroll system.

DXC has not been accused of causing the breach. But it published its annual accounts on the same Monday the news broke, showing a DKK 177 million loss on just under a billion in revenue — the latest in a run that adds up to more than DKK 2.8 billion in losses since 2017. Danish trade press has reported for years that the company carries responsibility for ageing systems that are difficult to replace. None of that is evidence of fault. All of it is relevant context when a country asks why a decades-old register had no volume alarm on it.

What likely went wrong — analysis, not confirmed findings

The authorities have not published a root-cause analysis. What follows is our reading of the publicly known facts, clearly labelled as analysis. Treat it as a set of hypotheses to watch, not conclusions.

1. The attempt count points to enumeration, not targeted queries

14 million attempts returning 8.8 million records is the signature of someone walking the keyspace rather than looking up specific people. Danish CPR numbers follow a predictable structure built around a date of birth plus a short sequence. That makes the full range of plausible numbers something a script can generate and iterate through. The misses — the roughly five million attempts that returned nothing — are the numbers that simply do not exist.

In other words, this probably was not a theft of a database. It was a system being politely asked to confirm every possible identity, one at a time, until it had the whole country.

2. The detection control was financial, not technical

This is the finding that should bother every security team reading this. 611 lookups a minute, sustained around the clock for ten days, through an account belonging to a small company, did not trip anything. There was evidently no effective rate limit, no baseline for normal query volume per customer, and no alert on a sudden four or five order-of-magnitude jump.

The billing system noticed because billing systems are built to notice unusual quantities. The security monitoring was not. A Danish crime commentator put the puzzle plainly on TV 2: either the perpetrators knew exactly what they were doing, or something in the system had gone badly wrong — because ten days is a long time in a logged system.

3. The likely initial access was ordinary

"Abuse of lawful access" covers a short list of unglamorous possibilities: stolen or phished credentials, an infostealer infection on an employee device, a leaked or hardcoded API key, a compromised third-party integration, or an exposed service with weak authentication. We have written about how one infected browser session becomes a breach and how MFA gets bypassed by a tired thumb. Nothing exotic is required to end up here.

4. The root cause is architectural, and it predates the attackers

Here is the uncomfortable part. Even a perfectly executed breach of names and ID numbers should not be able to damage a country this badly. It did, because Denmark — like many places — has spent decades using the CPR number as both an identifier (who you are) and an authenticator (proof you are that person).

An identifier is meant to be shareable. You give it to your doctor, your bank, your employer. It was never a secret. Using something that is printed on your health card as the thing that proves your identity over the phone was always a design flaw — it just took a breach of this size for the bill to arrive. As one Danish expert put it, the register can now only reliably tell one Jens from another Jens.

Red: why this was such an attractive target

• No malware on the target, no exploit, no intrusion into government infrastructure. The access was already authorised.
• Traffic through a legitimate business account looks like business as usual to anything that is only watching for intrusions.
• A predictable number format turns a lookup service into a bulk export, given enough time.
• The smaller supplier is the soft edge of a hardened system — the classic supply-chain path.
• CPR data does not expire. Unlike a password, you cannot rotate your national ID number.

Blue: what Denmark did within 48 hours

• Blocked the company's access and launched a full security review of the CPR system.
• Told authorities, organisations and businesses to stop releasing sensitive information on the basis of CPR number, name and address alone.
• Recommended MitID and two-factor verification as the identification route instead.
• Pharmacies tightened up: stating a CPR number is normally no longer enough to collect medication, with ID or control questions required — particularly for drugs with abuse potential.
• GPs were advised by their professional organisation to follow the same guidance.
• Public demand was enormous. The official advice site sikkerdigital.dk went from around 400 visits a day to 180,000 on the Monday, and the cyber hotline took about 1,000 calls against a normal 150.

That last statistic is the quiet good-news story here. A lot of people reacted on day one. The most common questions to the hotline were practical: what exactly leaked, who got access, am I affected, how worried should I be, and what is a credit warning.

If you live in Denmark, what to actually do

1. Expect the follow-up scams, because they are the real threat. The data itself is not the danger; what people do with it is. Someone who can state your full name, address and CPR number sounds exactly like your bank. That is the entire point of the fraud.
2. Adopt one rule: you call them, they never call you. If a bank, authority or company contacts you about the leak, hang up and call back on a number you looked up yourself. This single habit defeats nearly all of what is coming.
3. Never approve a MitID prompt you did not personally start. Your CPR number is now effectively public. MitID is doing the real work of protecting you. No legitimate employee will ever ask you to approve one for them.
4. Be ready to prove yourself differently. You will increasingly be asked for physical ID, control questions or a MitID login where a CPR number used to be enough. That friction is the fix working, not a system failing.
5. Consider a credit warning (kreditvarsel) if you are concerned about loans or accounts being opened in your name.
6. Talk to the people around you. Denmark's own agency made this point: the people most at risk are those who find scams hardest to spot. A five-minute conversation with an older relative is probably the highest-value thing you can do this week.

The lesson for everyone else

You do not need to be Danish for this to matter. Three things travel:

Your authorised third parties are part of your attack surface. Every partner with API access to your data is a copy of your front door held by someone whose security you do not control. Audit who holds access, what volume they should plausibly need, and what happens when that is exceeded.

Rate limits are a security control, not a performance setting. If a legitimate integration can pull your entire dataset given ten uninterrupted days, you do not have an access control — you have a speed bump with a login page. Alert on volume anomalies per account, not just on failed logins.

Never let an identifier become an authenticator. Customer numbers, national IDs, email addresses and dates of birth identify people. They do not prove them. Any process where reciting a known fact unlocks something is already broken — a breach just reveals it.

Sources

• The Copenhagen Post — CPR data breach exposes personal details of 8.8 million people in Denmark
• TV 2 — live coverage and press-briefing details
• TV 2 — Her er firmaet, der driver cpr-systemet
• TV 2 — Cpr-nummer er ikke længere nok: sådan forholder du dig
• Politiken — Only when a quick-thinking employee was about to send an invoice did anyone realize something was afoot
• Official guidance: sikkerdigital.dk