Massive Data Breach Exposes Personal Details of Nearly 9 Million Danes

A cyber‑attack on a third‑party service provider with authorized access to Denmark's central population registry has exposed the names, addresses and civil registration numbers of approximately 8.8 million individuals.

The breach, first reported by the security outlet Security Affairs, involved unauthorized entry into the database that stores virtually every identifying record for people linked to Denmark, including current residents, citizens living abroad and deceased individuals.

According to the information released, the attackers leveraged the legal access rights of the contractor to retrieve the data, bypassing the safeguards that normally protect the registry. The compromised data set comprises basic personal identifiers that, when combined, can facilitate identity theft, fraud or targeted phishing campaigns.

Denmark's Data Protection Agency has confirmed that it is cooperating with law‑enforcement authorities to investigate the incident and assess the scope of the exposure. Officials have emphasized that the breach does not appear to involve financial information such as bank accounts, but they warn that the CPR number, a unique identifier used across public and private services, is highly sensitive.

The incident highlights the growing cybersecurity challenges faced by governments that rely on external vendors for critical functions. Under the European Union’s General Data Protection Regulation (GDPR), the state is required to notify affected individuals and the supervisory authority of breaches that pose a risk to personal rights, prompting a series of alerts to be sent to those potentially impacted.

Experts note that the breach may prompt a review of access controls and third‑party risk management practices across public sector databases. Strengthening encryption, implementing stricter audit trails and limiting the data that contractors can retrieve are among the measures being considered.

As the investigation continues, Danish authorities have advised citizens to remain vigilant for suspicious communications and to report any signs of misuse of their personal information. The episode serves as a reminder of the delicate balance between efficient public service delivery and the protection of citizens' privacy in an increasingly digital world.