In what stands as one of the most extensive national identification breaches in European history, the Danish government has confirmed that unauthorized perpetrators accessed the Central Person Register (CPR), extracting names, addresses, and 10-digit CPR identification numbers belonging to approximately 8.8 million individuals. The incident was not caused by a direct infrastructure compromise of the registry itself, but rather by the systematic abuse of authorized API credentials hijacked from a private commercial partner permitted to interface with the national database.
Breach Anatomy: Supply Chain Abuse of Trusted Government Integrations
The Danish CPR system serves as the foundational civic identity backbone of Denmark. Every resident is assigned a unique, immutable 10-digit CPR number used for banking, health services, taxation, property leasing, and digital authentication (MitID).
To facilitate identity verification and address verification, select vetted commercial enterprises (such as financial institutions, credit bureaus, and utility providers) are granted direct query access to the CPR database via automated API endpoints.
According to preliminary forensic findings from the Agency for Digital Government (Digitaliseringsstyrelsen):
- Initial Access: Attackers acquired valid administrative or API service credentials from an authorized private Danish enterprise.
- Automated Scraping: Throughout September 2026, the adversaries generated continuous, distributed automated queries mimicking legitimate batch lookups to circumvent basic rate-limiting controls.
- Detection Timeline: Anomalous query patterns were detected on 2 October 2026, leading to the immediate termination of the partner's API certificate.
Scope of Exposure & Systemic Threat Radius
While Denmark's resident population is approximately 6 million, the CPR database maintains historical records spanning deceased individuals and emigrants, explaining the staggering total of 8.8 million affected entries.
| Exfiltrated Data Element | Sensitivity Level | Primary Exploitation Vectors |
|---|---|---|
| Full Legal Name | Low / Public | Spear-phishing correlation and identity matching |
| Residential Address | Medium | Physical mail fraud, social engineering, stalking |
| 10-digit CPR Number | Critical / National ID | Bank account verification bypass, telecommunication SIM swaps, fraud |
Authorities clarified that individuals who had previously enrolled in official name and address protection programs (navne- og adressebeskyttelse) were shielded by database-level access filters and their records were not disclosed.
Defensive Actions & Lessons for API Supply Chain Security
Digitalization Minister Christina Egelund described the breach as deeply serious, initiating a comprehensive review of all third-party access agreements across government registries:
- Mandatory Mutual TLS & IP Whitelisting: Federal and commercial data stewards must ensure API consumers authenticate using hardware-bound mTLS certificates combined with strict, dedicated IP whitelisting.
- Behavioral Anomaly & Bulk Query Detection: API gateways interfacing with sensitive sovereign citizen registries must deploy behavioral analysis capable of flagging distributed automated lookups even when initiated with valid tokens.
- Citizen Precautions: Danish residents have been instructed to exercise heightened vigilance against unsolicited calls, text messages, or emails claiming to represent banks or public agencies, reminding citizens that public officials will never request passwords or secondary MitID authentication over the telephone.
