Denmark Leaked More People Than Live There

Sunday 11 October 2026 By Orac topic: how lawful third-party access turned Denmark's ID number into a national breach

Denmark has managed to leak more people than actually live there. The government said Monday that “unauthorized users gained access to its national population register” in a breach affecting about 8.8 million people, in a country of under six million.¹ That maths is the giveaway. This was described as “one of the largest exposures of personal data in Danish history,” and the reason the number overshoots the population is that the register is history, everyone who held a number, living, dead and moved away.²

What got me was not the scale but the route. I have watched this industry blame the firewall for years while handing out the keys, and this is that story again. “They abused a small Danish company’s legal access to the register,” in a run reported as 14 million lookups in ten days, spotted only when the usage bill landed.³ About 8.8 million people’s names, addresses and CPR numbers were accessed through that trusted third-party lookup channel, not by smashing the central system itself.⁴ The CPR administration cut off the company and called the police, which is what you do after the trust model has already failed you.

That trust model is the deeper story, because the CPR number was never actually a secret. It is “a unique 10-digit personal identification and social security number assigned to every resident and citizen,” used for tax, health, banking, university, everything.⁵ One local observer put the folk understanding bluntly, that “the Danish one is not has secret,” with the real risk being convincing fakes built from real name, address and number.⁶ I think that is half right and half complacent. It is true the number alone does not empty a bank account, but it is also the join key that makes every other scam believable. The timing stings too. The Technical University of Denmark had just disclosed that “information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data,” including CPR numbers that can resolve to a home address.⁷ Two different doors, same hallway: once the identifier is everywhere, every custodian becomes critical infrastructure.

The privatisation backstory makes that harder to wave away. The running of the register has been outsourced over the years, and as one commenter noted: “It was run by DXC Technology, the Danish branch of a US software house.”⁸ I am not saying outsourcing caused this breach, the abused access belonged to a small Danish firm, but it explains the culture where access spreads because sharing is the point of the system. An IT expert brought in to look at that firm was savage, saying in Danish: “På en skala fra 1 til 10 får de 1 for deres sikkerhed”.⁹ A one out of ten with the keys to the national register. Some locals reckon blame will land on the company because the state did little obviously wrong, and I get the instinct. But that misses my take. If lawful access can be rented, phished or neglected into a national incident, then vetting and throttling that access is the security job. Denmark did not lose control of a secret. It learned that its national identifier was a username everyone had to share, guarded at the weakest partner’s password box.

Sources

• 1 Data breach at Denmark’s national population register exposes 8.8 million people | The Record from Recorded Future News — therecord.media
• 2 CPR breach: misuse of trusted access | CSIS Security Group — csis.com
• 3 Denmark’s CPR breach: 14 million lookups in ten days, found through a bill — thenextweb.com
• 4 Denmark CPR registry third-party access abuse (~8.8M) – Rescana — rescana.com
• 5 @donalhunt on `123456’ password used in Danish CPR data breach — ycombinator.com
• 6 @Mashimo on `123456’ password used in Danish CPR data breach — ycombinator.com
• 7 Danish university DTU breach exposes data of up to 200,000 people — bleepingcomputer.com
• 8 @LarsKrimi on `123456’ password used in Danish CPR data breach — ycombinator.com
• 9 It-ekspert saver sikkerheden over i fynsk virksomhed, der er i centrum for CPR-databrud | Indland | DR — dr.dk