Data of 8.8 million people exposed in Denmark in a security incident

The personal data of around 8.8 million people in Denmark were made accessible to unauthorised persons through a security incident involving the country’s Central Person Register (CPR).

According to the Danish broadcaster DR, the incident has been described by the Ministry of Research, Education and Digitalisation as “deeply serious”, while the authorities have begun work to determine the full extent of the event.

According to the ministry, the unauthorised access was made possible through the misuse of a Danish company’s legitimate right to carry out searches in the CPR system.

The authorities immediately suspended the company’s access to the register and notified the Danish Data Protection Agency.

The exposed data include names, addresses and personal identification numbers. According to the ministry, the incident did not affect the names and addresses of persons who have requested protection of these data.

The Minister of Research, Education and Digitalisation, Christina Egelund, has urged citizens to be careful and not to share passwords or other confidential information in response to suspicious phone calls, emails or other contacts.

The authorities warn that citizens should be especially careful even in cases where the person contacting them holds accurate data such as their name, address or CPR personal number.

Denmark’s Central Person Register contains data on around 11 million people, including deceased persons and Danish citizens who have left the country.