8.8 Million Danish Identity Records Copied via Legitimate Company Login
October 6, 2026 · Frisian News
Photo: Wikimedia Commons
Unknown intruders copied names, addresses and CPR numbers for 8.8 million people from Denmark's central population register during September 2026, the government confirmed on October 5. The breach exploited a private company's lawful access to the system, not a technical vulnerability.
8.8 million records from Denmark's central population register were copied by unknown intruders during September, the Danish Ministry of Research, Education and Digitalisation confirmed on October 5. The country has about six million residents. The register holds 11 million entries in total, including the dead and those who have moved abroad, according to the ministry's statement as reported by brusselssignal.eu.
The three fields taken were names, addresses and CPR numbers, Denmark's permanent 10-digit personal identification numbers that run through every citizen's tax, health and banking records for life. The ministry told brusselssignal.eu that those fields had been copied, not merely viewed. Because the number is permanent, the exposure does not expire when the news cycle ends.
No technical exploit opened the system. Intruders used the lawful search access belonging to one unnamed Danish private company, according to the ministry's statement as reported by cybernews.com. Under Section 38 of Denmark's Civil Registration Act, reported by cybersecuritynews.com, private companies with a legitimate interest may query the register for a defined group of people identified in advance. That verification channel, built for routine business use, became the attack path.
Datatisynet, Denmark's data protection authority, said a very large number of automated lookups hit the system, according to unboxfuture.com, pointing to scripted harvesting rather than manual browsing. TV 2, cited by unboxfuture.com, reported the access ran for 10 days in September. Analyst Nathan Davies-Webb of Acumen Cyber, quoted by unboxfuture.com, calculated that the breach reached roughly 80 percent of everyone ever registered in the system. One company's credentials, in 10 days, exposed most of a national archive.
The CPR administration detected irregular behaviour on the evening of October 2, according to cybernews.com. The access had already run during September. Authentication was present throughout. The access itself was lawful on its face. The perimeter held while the front door was used exactly as designed.
Minister Christina Egelund called it "a deeply serious incident" and briefed parliament's Business and Digitalisation Committee, according to brusselssignal.eu. She ordered a full security review of the register. The company's access has since been blocked and the arrangement ended. The case was reported to Datatilsynet on October 4 and passed to the police. No suspect has been named and no motive given.
This is not an isolated pattern in Europe. Between May and August this year, a hacker calling himself ZeroBytes took tax files from France's public-finances directorate using stolen passwords and a compromised surveyor's login, exposing data on about 353,000 individuals and 252,000 firms, brusselssignal.eu reported. France's national cyber security agency ANSSI, in a September report cited by brusselssignal.eu, attributed the entry to absent multi-factor authentication, below-standard passwords and work accounts used from personal devices. The European Union's NIS2 directive, which member states were due to write into national law by October 2024, extends security duties to public administration. The rules have not closed the gap between the volume of data now held centrally and the access controls governments actually apply.
When one company's login can empty most of a nation's identity archive in 10 days, the question is not whether the perimeter held but whether it was ever drawn in the right place.
Frysk8,8 miljoen gegevens út it sintrale befolkingsregister fan Denemarken waarden yn septimber kopiearre troch unbekende ynbrekkers, sa befestige it Deenske Ministearje fan Ûndersyk, Underwiis en Digitalisearring op 5 oktober. It lân hat sa'n seis miljoen ynwenners. It register befettet yn totaal 11 miljoen yngongen, mei ynbegrip fan de deaden en dyjingen dy't nei it bûtenlân ferhuze binne, neffens de ferklearring fan it ministearje sa't brusselssignal.eu melde.
De trije fjilden dy't meinommen waarden wiene nammen, adressen en CPR-nûmers, Denemarken syn bliuwende 10-siferrige persoanlike identifikaasjenûmers dy't foar it libben troch alle belesting-, sûnens- en bankgegevens fan elke boarger rinne. It ministearje fertelde brusselssignal.eu dat dy fjilden kopiearre wiene, net allinnich besjoen. Om't it nûmer bliuwend is, ferrint de bleatstelling net as de nijssyklus einiget.
Gjin technysk eksploit iepene it systeem. Ynbrekkers brûkten de wetlike syktagong fan ien net-neamd Deensk privee-bedriuw, neffens de ferklearring fan it ministearje sa't cybernews.com melde. Op grûn fan Artikel 38 fan de Deenske Wet op Boargerlike Registraasje, sa't cybersecuritynews.com rapportearre, meie privee-bedriuwen mei in legitim belang it register befragje foar in fan tefoaren oanwiisd groep minsken. Dat ferifikaasjekanaal, boud foar rûtinebrûk yn it bedriuwslibben, waard it oanfalspaad.
Datatilsynet, de Deenske autoriteit foar gegevensbeskerming, sei dat in hiel grut oantal automatisearre opsykingen it systeem troffen, neffens unboxfuture.com, wat wiisd op skripte gegevensôfhelling ynstee fan manueel trochblêdzjen. TV 2, oanhelle troch unboxfuture.com, melde dat de tagong 10 dagen yn septimber rûn. Analist Nathan Davies-Webb fan Acumen Cyber, oanhelle troch unboxfuture.com, berekkene dat it ynsidint sawat 80 prosint fan elkenien berikt hie dy't ea yn it systeem registrearre wie. De oanmeldgegevens fan ien bedriuw stelden yn 10 dagen it grutste part fan in nasjonaal argyf bleat.
De CPR-administraasje detektearre ûnregelmatich gedrach op de jûn fan 2 oktober, neffens cybernews.com. De tagong hie al rûn yn septimber. Autentikaasje wie de hiele tiid oanwêzich. De tagong sels wie wetlik fan uterlik. De perimeter hold wylst de fooardoar krekt sa brûkt waard as er ûntworpen wie.
Minister Christina Egelund neamde it "in djip earnstich ynsidint" en ynformearre de Kommisje foar Bedriuwslibben en Digitalisearring fan it parlemint, neffens brusselssignal.eu. Se joech opdracht foar in folsleine feiligenskontrôle fan it register. De tagong fan it bedriuw is sûnt blokkearre en de ôfspraak beëinige. De saak waard op 4 oktober meld by Datatilsynet en oerjûn oan de plysje. Gjin fertochte is neamd en gjin motief jûn.
Dit is gjin isolearre patroan yn Europa. Tusken maaie en augustus dit jier naam in hacker dy't himsels ZeroBytes neamt, mei help fan stellen wachtwurden en in kompromittearre oanmelding fan in lânmjitter, belestingbestannen fan it Frânske direktoraat foar publike finânsjes, en stelde gegevens bleat oer sawat 353.000 persoanen en 252.000 bedriuwen, sa rapportearre brusselssignal.eu. It Frânske nasjonale cyberfeiligensagintskip ANSSI, yn in septimberrapport oanhelle troch brusselssignal.eu, brocht de tagong yn ferbân mei it ûntbrekken fan multifaktorautentikaasje, wachtwurden ûnder de noarm en wurkakkounts dy't fan persoanlike apparaten brûkt waarden. De NIS2-direktyf fan de Europeeske Uny, dy't lidsteaten yn oktober 2024 yn nasjonale wetjouwing opnimme moasten, wreidet feiligensferplichtingen út nei publike administraasje. De regels hawwe de kleau net sletten tusken de hoemannichte gegevens dy't no sintraal bewarre wurde en de tagongskontrôles dy't regearingen wirklik tapasse.
As de oanmelding fan ien bedriuw yn 10 dagen it grutste part fan in nasjonaal identiteitsargyf leechhelje kin, is de fraach net oft de perimeter hold, mar oft er ea op it goede plak lutsen waard.
Published October 6, 2026 · Frisian News