Personal information linked to about 8.8 million records in Denmark’s national population registry has reportedly been accessed by hackers, prompting the Danish government to launch an investigation into the serious security incident.

The breach involves sensitive information including names, addresses and CPR numbers, which serve as Denmark’s equivalent of social security numbers.

Key Takeaways

• Hackers reportedly accessed information connected to about 8.8 million records in Denmark’s national population registry.
• The affected information includes names, addresses and CPR numbers.
• The access was reportedly obtained through a Danish company that had legal access to the registry.
• The company’s access to the database had not been revoked, according to Danish authorities.
• The government is investigating how the breach occurred and who was responsible.

What Information Was Accessed?

The compromised registry contains personal information relating to people who are currently living in Denmark, as well as some people who have died or moved out of the country.

Among the information reportedly accessed were names, addresses and CPR numbers.

CPR numbers are personal identification numbers used in Denmark and are comparable to social security numbers in other countries.

The scale of the reported access has made the incident particularly serious because the information concerns millions of records held within a national population database.

Why the 8.8 Million Figure Is Higher Than Denmark’s Population

The reported figure of 8.8 million records is larger than Denmark’s population, which is about six million people.

That difference is linked to the way the national registry is structured.

The database contains records not only for people currently living in Denmark but also information relating to people who have died or emigrated from the country.

Authorities said the registry contains information on around 11 million people in total, helping explain why the number of records reportedly affected is greater than the country’s current population.

How the Hackers Reportedly Gained Access

The Danish government said the hackers did not access the registry through an unknown outside route.

Instead, authorities said access was obtained through a Danish company that had legal access to the database.

The company’s authorization to access the registry had not been revoked, according to the authorities.

This detail is now an important part of the investigation as officials seek to establish how the attackers were able to use an authorized access route to reach the information.

Danish Government Calls the Incident Extremely Serious

Denmark’s Ministry of Digital Affairs disclosed the breach on Monday and described it as an “extremely serious incident.”

Digital Affairs Minister Christina Egelund said the government was working with relevant authorities to determine the full impact of the breach.

“This is an extremely serious incident,” Christina Egelund said.

The government has not yet established the full extent of the information accessed.

The identities of the hackers also remain unknown.

Why the Breach Matters to People Whose Records Are Involved

The information identified by authorities includes personal details such as names, addresses and CPR numbers.

Because the source material does not establish that the stolen information has already been used for fraud, identity theft or other crimes, those consequences should not be assumed.

What is established is that a large volume of personal information was accessed and that Danish authorities are investigating the circumstances surrounding the breach.

The incident therefore places particular attention on how access to sensitive government databases is granted, maintained and monitored.

What Happens Next?

Authorities are continuing their investigation into how the breach occurred and who was responsible.

Officials are also assessing the full extent of the information that was accessed.

A central question for the investigation is how hackers were able to gain access through a company that was legally authorized to connect to the national registry, and why that access had not been revoked.

Until the investigation provides further findings, the precise circumstances surrounding the breach and the full consequences for the affected records remain unclear.

For now, the Danish government’s assessment is clear: the reported access to millions of personal records represents a serious incident requiring further investigation.