Story perspectives

Hackers Breach Denmark’s CPR Register, Exposing 8.8 Million

By Drooid · Oct 6, 2026, 12:22 PM UTC · How we work

Summary

Hackers Breach CPR Register

Digital affairs minister Christina Egelund said hackers breached Denmark’s Central Person Register.
The breach exposed personal data of roughly 8.8 million registered individuals, including names, addresses and CPR numbers.
Hackers accessed the system using legitimate login credentials of a Danish company authorized to handle CPR data.
Police and the data protection authority launched an investigation after the anomaly was discovered in September.
The breach was publicly reported on 5 October 2026.

Summary

Denmark Traces Hackers

Hackers demanded 1.5 Bitcoin (? $168,000) to stop public release of stolen CPR data.
Attackers employed a double-extortion method, offering decryption only after ransom payment.
Denmark’s government is collaborating with Europol and national security agencies to trace the perpetrators.
Potential GDPR fines could equal 4 % of the national administrative budget, increasing financial pressure.
Officials urged citizens to set credit alerts on borger.dk to block fraudulent loan applications.

History

Historical Context

In May-July 2017 hackers exploited an unpatched Apache Struts flaw to steal data on about 147.9 million Americans from Equifax, a breach disclosed on September 7 2017. The FTC, CFPB and states settled the fallout for $700 million in July 2019, spurring tougher data-protection rules worldwide. Denmark’s Digital Affairs Minister Christina Egelund now faces a similar hack of the Central Person Register, with attackers demanding 1.5 Bitcoin and Europol assistance.

1 of 3

Hackers Breach CPR Register

Digital affairs minister Christina Egelund said hackers breached Denmark’s Central Person Register.
The breach exposed personal data of roughly 8.8 million registered individuals, including names, addresses and CPR numbers.
Hackers accessed the system using legitimate login credentials of a Danish company authorized to handle CPR data.
Police and the data protection authority launched an investigation after the anomaly was discovered in September.
The breach was publicly reported on 5 October 2026.

1 / 3