Unauthorized parties gained access to the names, addresses and personal identification numbers of roughly 8.8 million people held in Denmark’s Central Person Register (CPR), the country’s Ministry of Digitalisation announced on October 5. The access came through a private Danish company that held lawful access to the register.
The register itself was not hacked. A trusted third party was. For anyone responsible for systems that share data with partners, that distinction is the whole story.
What happened
The unauthorized access ran for about 10 days in September through the company’s compromised account. It was spotted by an employee of the register’s administration on Friday, October 2.
According to Denmark’s data protection authority, a very large number of automated lookups were made in the register to identify valid personal identification numbers.
Official statements do not explain how the attackers got into the company’s systems, whether they kept the data, or which company was involved.
The scale
The 8.8 million records amount to about four-fifths of the register’s roughly 11 million entries. Besides current residents, the CPR holds records on people who have emigrated, people who have died and other categories. Denmark’s population was under 6 million at the start of 2025.
The exposed data stayed within the scope private companies are normally allowed to access. Names and addresses of people with protected registration status were not included.
The response
The register’s administration reported the incident to Datatilsynet, the Danish data protection authority, and the police are investigating. Minister for Digitalisation Christina Egelund acknowledged that the safeguards had been inadequate and ordered a full security review.
The CPR Act allows a new identification number to be issued where misuse is documented, but Egelund said it was too early to say whether citizens would be given new numbers.
Residents are being told to treat unexpected messages that use their personal details with suspicion, avoid links in unsolicited messages, never share MitID credentials, passwords or card details, and consider setting a credit warning marker on borger.dk. A credit warning is a flag in the CPR telling companies that the holder does not want loans extended in their name.
That advice reflects the real downstream risk. A name, an address and a valid national ID number are exactly what fraudsters need to make phishing emails and phone calls posing as banks, tax authorities or couriers sound convincing.
A pentester’s reading of the incident
Strip away the national scale and this is a pattern we run into on engagements all the time: a high-value data source exposed through a partner integration that was trusted more than it was tested. Three weaknesses stand out.
- Third-party access treated as inside the perimeter. Once a partner account is authenticated, many systems stop asking questions. Whoever controls that account, legitimately or not, inherits the partner’s full reach. The security of the register effectively became the security of its least protected client.
- No meaningful limits on volume. A legitimate business looking up customers it actually serves produces a modest, predictable flow of queries. Millions of automated lookups from one account look nothing like that. Per-client rate limits and hard quotas tied to real business need would have capped the damage, whatever happened on the partner’s side.
- Detection measured in days, not minutes. The activity ran for about 10 days before a person noticed it. Behavioral baselines per integration, with automatic alerts on sharp deviations, are what turn a breach of 8.8 million records into an incident involving a few thousand.
None of these are exotic controls. They are the questions a properly scoped API penetration testing and third-party access assessment asks: what can a single partner credential reach, how fast can it pull data, and how long until someone notices. Under GDPR and NIS2, those questions apply to any organization that shares personal data with suppliers, whether in Denmark, Cyprus or anywhere else in the EU — the same scope our GDPR-focused penetration testing engagements are built around.
If your organization exposes data to partners through APIs or portals and you have never had that access path tested from the attacker’s side, the Danish case is a good reason to start. That is the kind of assumed breach assessment the Cyprus Pentest team carries out.