Hackers get data of 8.8 million in 'extremely serious' Danish breach

According to The Edge Malaysia, which carried Bloomberg's report, the government said unidentified individuals misused a private Danish company's legitimate access to search the Central Person Register, known as CPR[2].The Copenhagen Post reports that the CPR administration has since blocked the company's access[3]. The Hacker News reports that police are investigating[4].According to Help Net Security, the CPR administration learned on the evening of Friday, 2 October 2026, that there had been irregular activity in the system during September[5]. The outlet says the administration notified the Danish Data Protection Agency (Datatilsynet)[5] on 4 October.The Record reports that the Data Protection Agency described the breach as involving a very large number of automated searches on the system aimed at identifying valid CPR numbers[1].The Copenhagen Post reports that, based on the review so far, the names and addresses of people who have registered for name and address protection were not exposed[3].The Record says the register holds information on around 11 million people, including current residents, people who have moved abroad and those who are deceased[1]. It is advising citizens never to hand over passwords or other confidential details by phone or email, "even if the recipient apparently knows your name, address and CPR number."[5]The Edge Malaysia reports that Egelund has ordered a comprehensive security review of the CPR system[2].