A partner’s login pulled 8.8 million Danish records — check what your vendor keys can pull

Nobody broke into Denmark’s population register. Someone borrowed a small company’s legitimate access to it and ran lookups for about ten days in September. By the time a CPR employee noticed the unusual activity on Friday, October 2, names, addresses and personal ID numbers for about 8.8 million people had been pulled. If a vendor holds an API key to your customer data, this is the scenario to rehearse.

The login was legitimate. The volume wasn’t. It took ten days for anyone to notice.

One partner login, 8.8 million lookups

Denmark’s Central Person Register (CPR) announced on October 5 that unauthorized parties misused a Danish company’s lawful access to search the CPR system. They obtained names, addresses, CPR numbers and other details for roughly 8.8 million registered people, including living residents, people who have emigrated and people who have died. The system holds about 11 million records. CPR says the data does not include names and addresses of people registered with name and address protection.

Denmark’s data protection authority, Datatilsynet, received the breach notification on Sunday, October 4. It says the report describes a very large number of automated lookups made to identify valid CPR numbers. According to the ministry, the queries stayed within the categories of data private companies are allowed to receive. CPR has cut off the company’s access, police are investigating, and the ministry has ordered a full security review of CPR. Minister Christina Egelund told the Danish news agency Ritzau that the access ran for about ten days, and that the safeguards around this company’s access had not been good enough. Officials have not said who is behind it.

Valid credentials, wrong volume

Nobody exploited a bug. A third party used real credentials with correct per-query permissions. What failed was volume and pattern: a partner suddenly enumerating most of a country for days. Most organizations carry the same exposure in partner APIs, data brokers and service accounts. A list of names, addresses and national ID numbers is also what makes a phone scam sound official. That is why the Danish government is warning people not to trust callers just because they know those details.

Baseline partner keys and alert on spikes

• List every partner, vendor and service account with query access to customer or employee records. Write down who owns each one.
• For each, set a volume baseline and alert on spikes: records per hour, distinct IDs per day, failed or “not found” lookups. Enumeration produces lots of misses.
• Rate-limit partner keys, and require partners to look up records they already hold identifiers for, not walk the ID space.
• If you have Danish staff or customers, tell your help desk and finance teams: a caller who knows someone’s name, address and CPR number is not verified by that.

Details

• Who: Det Centrale Personregister (CPR), Denmark’s national civil registry. Details published by CPR and the Ministry of Research, Education and Digitalization (Forsknings-, Uddannelses- og Digitaliseringsministeriet).
• Scope: About 8.8 million registered people (living, emigrated, deceased and others) out of about 11 million records. Names, addresses, CPR numbers and more. People with name and address protection: names and addresses not included.
• How: Misuse of a private Danish company’s lawful CPR query access. Datatilsynet: very large number of automated lookups to identify valid CPR numbers.
• When: About ten days in September 2026. Spotted the evening of Friday, October 2. Reported to Datatilsynet Sunday, October 4. Announced Monday, October 5.
• Response: Company access blocked; police investigation; full CPR security review; Cyberhotline for digital safety +45 33 37 00 37, with extended hours (8:00–24:00 local) in the coming days; guidance at sikkerdigital.dk.

Hunt / verify

• Pull 90 days of query logs for each partner key and compare the daily distinct-record count with the contract’s expected volume.
• Look for sequential or near-sequential identifier lookups and high “not found” rates from any one key.
• Confirm partner keys are tied to known source IPs, and find out who at the partner can use them.

About 8.8 million people’s names, addresses and ID numbers left Denmark’s CPR registry through one company’s legitimate access over about 10 days in September. Baseline partner and API key volume. Alert on enumeration patterns. Rate-limit partner keys. Tell the help desk that knowing someone’s CPR number does not verify a caller.

Sources

• https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger
• https://ufm.dk/aktuelt/pressemeddelelser/2026/oktober/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger
• https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-er-opmaerksom-paa-sag-om-opslag-i-cpr
• https://www.bt.dk/samfund/nye-detaljer-om-cpr-laekage-de-havde-adgang-gennem-ti-dage
• https://www.bleepingcomputer.com/news/security/denmark-population-registry-data-breach-affects-88-million-people/

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].