Loading story…
Denmark confirmed that unauthorized parties accessed Central Population Register (CPR) records belonging to approximately 8.8 million people, exposing names, addresses and CPR numbers. Attackers misused an unnamed private Danish company’s authorized access during September. The initial entry method remains unknown, and authorities have not identified a specific vulnerability or threat group. Protected names and addresses were excluded from the unauthorized access, but officials did not confirm that other information belonging to those individuals was unaffected.
CPR administrators detected unusual activity on October 2 and subsequently blocked the company’s access, engaged specialists and notified Denmark’s Data Protection Authority. Police are investigating, while Minister Christina Egelund requested a thorough review of CPR security; authorities said preventive measures were already underway. Officials warned residents that the exposed information could support convincing phishing attempts and expanded access to security guidance. The incident highlights the risk posed by third-party access to sensitive population data, even where that access was originally authorized.
See attribution, scope, and your downstream exposure.
13 events from the most recent confirmed update back to the earliest known activity.
Denmark confirmed in an official statement that unauthorized parties accessed CPR records belonging to approximately 8.8 million people. Authorities did not disclose the implicated company, the initial access method, a specific vulnerability, or a threat-group attribution.
The CPR administration detected unusual system behavior on Friday evening, October 2, triggering investigation of the unauthorized access.
CPR staff observed irregular system behavior during September, before the breach detection on October 2 already recorded in the timeline.
Unauthorized parties used an unnamed private Danish company's lawful CPR access to obtain records belonging to approximately 8.8 million people. Exposed information included names, addresses, and CPR numbers.
Danish digitization minister Christina Egelund said it was too early to determine whether Denmark would issue new CPR numbers following the breach affecting approximately 8.8 million people.
Denmark's Data Protection Agency, Datatilsynet, opened a case to investigate what happened, how the unauthorized access was possible, and who was responsible for processing the affected personal data.
Denmark's Data Protection Agency described a very large number of automated searches intended to identify valid CPR numbers. The attackers used an unnamed domestic company's legitimate access to the register.
Danish authorities warned that exposed personal details could make fraudulent messages and calls appear convincing, and advised residents not to disclose passwords or confidential information in unexpected communications. The Cyberhotline extended its opening hours to provide additional security guidance.
Minister Christina Egelund informed Parliament's Business and Digitalization Committee and requested a thorough security review of CPR. Officials said preventive measures had begun but did not disclose their technical scope.
Police and other relevant authorities began investigating how the company's permitted access was misused on such a large scale. The inquiry was described as being at an early stage.
The CPR administration notified Denmark's Data Protection Authority of the personal-data breach.
Over the weekend following detection, officials established that unauthorized access covered approximately 8.8 million registered people. The review found that protected names and addresses were excluded, without establishing whether other fields for those individuals were unaffected.
Authorities blocked the implicated company's access to CPR and engaged specialists to map the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
24 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecysecurity.news
Open sourcemalware.news
Open sourcetheregister.com
Open sourceufm.dk
Open sourcesikkerdigital.dk
Open sourcedatatilsynet.dk
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Technical University of Denmark (DTU) disclosed a personal-data breach after attackers used compromised user credentials to access **DTUBasen**, its identity and access management system, and download data. Up to approximately **200,000 current and former users** may be affected, with records dating back to 2003. Potentially exposed information includes Danish civil registration (CPR) numbers, names, addresses, contact details, employment information, profile photographs, and registered next-of-kin details. DTU cannot determine precisely which records were downloaded or how many people were affected. DTU said it contained the attack, engaged external specialists, notified the Danish Data Protection Authority, and referred the incident to relevant authorities for investigation. The university is notifying affected individuals where possible and using its public disclosure to reach people it cannot contact directly. It warned of identity theft and targeted phishing risks, advising affected users to practice password hygiene, remain alert to unsolicited communications, and consider placing a credit warning against their CPR number where appropriate.
Oct 6, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026
Polish healthcare software provider **MyDr** said it is investigating a serious security incident after alleged attackers claimed access to patient data from numerous clinics using its systems. According to reports, the threat actors said they obtained **18,814,422 unique PESEL numbers** from medical systems, raising the prospect of one of the country’s largest healthcare-related data exposures. Journalist Adam Haertle reportedly received the claim directly, attempted to validate it, and alerted the relevant authorities. Polish media and officials subsequently described the incident as a major breach affecting the medical data of roughly **19 million people**. MyDr is one of Poland’s largest electronic medical records providers, serving thousands of healthcare facilities and supporting millions of visits and prescriptions each month, which suggests the compromise could have broad downstream impact across clinics and patients if the attackers’ claims are confirmed.
Aug 13, 2026