Denmark has confirmed a major data breach involving its Central Population Register, known as CPR, after unauthorized parties accessed personal records belonging to about 8.8 million people. The exposed information includes names, addresses, and CPR numbers, according to an official statement published on October 5, 2026.
The figure exceeds Denmark’s population of roughly six million because the register also holds records of people who have moved abroad and those who have died. Officials said the CPR system currently contains approximately 11 million registered people, meaning the incident affected a large share of its records.
…
The attackers misused a private Danish company’s lawful access to search the CPR system during September. Authorities have not described how the unauthorized parties obtained or used that access, leaving the initial entry method unknown.
The confirmed route is important: this was misuse of an approved company connection, not a publicly confirmed software flaw in the register. The ministry has not disclosed the company’s name, linked the incident to a known threat group, or identified a specific vulnerability.
…
Research, Education and Digitalization Minister Christina Egelund described the incident as deeply serious. She informed Parliament’s Business and Digitalization Committee and requested a thorough security review of CPR. Officials said preventive measures had already started, without detailing their technical scope.
…
Names, addresses, and national identification numbers can make fraudulent messages and calls appear convincing. Cybersecurity News’ coverage of the Pentagon data breach similarly highlights the risks when personal records include identity numbers, while its phishing prevention guidance explains common warning signs.
…
I know and what I’m sayin is that this is by design. It’s not only about competence, competence can be bought. It’s structurally difficult because various different ministries and independent bureaucracies would need to decide to cooperate and do tedious work to combine data sets like this. It’s not a magical antidote but a structural impedance that is supposed to make abuse more difficult, obviously not impossible.
And BundID does not entirely change to his. BundID does not assign you a unique identifier either. You get a temporary process-based ID that is generated as you apply for a government service and that is forwarded throughout the process. BundID itself only has a basic user name that you pick yourself and that is not used or stored anywhere outside it. The actual authentication is done via the eID, Elster certificate, etc. which all don’t leave cryptographic traces.
Don’t get me wrong, this system is still kind of broken. BundID still bundles important information in a central location and urgently needs modernization. And it’s authentication amounts to ‘trust me bro’ from the POV of any other government service. But it does not introduce a global unique identifier either.