# Denmark’s population register: names, addresses and ID numbers of 8.8 million people taken through a private supplier’s access > Danish authorities say unauthorised users misused a private company’s legitimate CPR access, taking names, addresses and CPR numbers of about 8.8 million people. FireAI Security & Research Team (HisnLabs) · Published 2026-10-13 Canonical: https://hisnlabs.com/en/news/denmark-cpr-population-register-8-8-million-supplier-access-misused On 5 October 2026 the administration of Denmark’s Central Person Register (CPR) announced that unauthorised parties had obtained the names, addresses and CPR numbers of about 8.8 million registered people by misusing the legitimate access of a private Danish company [[1]](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger). Help Net Security reports that the group includes people living in Denmark, deceased people and citizens who have moved abroad [[2]](https://www.helpnetsecurity.com/?p=386873). ## Background The CPR is Denmark’s national population register. Every person in it has a ten-digit CPR number, which public bodies and many private companies use to identify people. Some private companies are allowed to look up limited information in the register, and the access in this case was one of those company accounts [[1]](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger) [[2]](https://www.helpnetsecurity.com/?p=386873). ## What the reports describe According to Help Net Security, the CPR administration learned on the evening of Friday 2 October 2026 that there had been irregular activity in the system during September. It established the extent of the access over the weekend and notified the Danish Data Protection Agency on Sunday 4 October, and the Ministry of Research, Education and Digitalisation made the incident public on 5 October [[2]](https://www.helpnetsecurity.com/?p=386873). The CPR notice puts the number of affected people at about 8.8 million and lists names, addresses and CPR numbers as the data obtained. It says people who have registered name and address protection are not included [[1]](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger). The register holds about 11 million records, so the group is roughly four fifths of it [[2]](https://www.helpnetsecurity.com/?p=386873). The attackers “stayed within the limits of the information that private companies are allowed to retrieve”, in the wording Help Net Security attributes to the announcement [[2]](https://www.helpnetsecurity.com/?p=386873). In other words, the data was obtained through a permitted kind of query, run by parties who should not have been running it. The CPR notice says the company’s access has been suspended, that specialists and the authorities are investigating, and that the incident has been reported to the Data Protection Agency and the police [[1]](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger). > Stolen identity details are often used to make phishing messages and calls more convincing. FireAI, the on-device firewall for macOS developed by HisnLabs, asks before a newly installed app connects to the internet. A 17-day trial is available. [Download FireAI for Mac](https://hisnlabs.com/fireai/en/download) ## Implications for Mac users The data taken is identifying information, not passwords or financial details, and the notice does not say that any account was opened or any money moved [[1]](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger). The practical risk is impersonation. A message that quotes a person’s correct name, address and CPR number looks more trustworthy than one that does not, and Help Net Security reports that citizens are advised never to share passwords or confidential information by phone or e-mail, “even if the recipient apparently knows your name, address and CPR number” [[2]](https://www.helpnetsecurity.com/?p=386873). The warning applies to e-mail on a Mac as much as to the phone. The case also shows a risk that no single user controls: a register that is secure in itself can still be queried through a supplier’s account. The people affected could not have prevented it, and what remains in their hands is how they respond to contact that uses the stolen details. ## Recommendations 1. Treat any message, call or text that quotes a CPR number as unverified, however accurate the details are, and contact the organisation through a number or site found independently. 2. Never enter passwords or approve a sign-in prompt because a caller or sender knows personal details. 3. Install software only from its official source, since stolen identity data makes fake download pages and fake support messages more convincing. 4. Check the CPR administration’s own channels for updates rather than links sent by message. ## Relevance to FireAI FireAI is a firewall for outgoing connections on the Mac. It asks the user before an app that has not connected before reaches the internet, and the user can allow or block it, so an app installed after a convincing fake message does not connect silently. It does not stop phishing messages from arriving, cannot protect data held in a government register or a supplier’s systems, and does not verify who is contacting the user. > FireAI shows which app wants to connect and where, and waits for the user’s decision. It runs on the Mac and does not send the user’s activity anywhere. A 17-day trial is available. [Download FireAI for Mac](https://hisnlabs.com/fireai/en/download) ## Limitations The notice does not name the company whose access was misused, say how the attackers obtained it, or say how long the access lasted beyond the month of September, and the identity of the perpetrators had not been established when the reports were published [[1]](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger) [[2]](https://www.helpnetsecurity.com/?p=386873). Whether the data has been published or sold is not stated. Counts and dates here are the authorities’ own, as relayed by Help Net Security, and may change as the investigation proceeds. Try [FireAI, by HisnLabs](https://hisnlabs.com/fireai/en/download) free for 17 days. ## Sources - [CPR Administration (Denmark), 5 October 2026: Omfattende uautoriseret adgang til borgeres CPR-oplysninger](https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger) - [Help Net Security, 6 October 2026: Data breach at Denmark’s population register exposes 8.8 million people](https://www.helpnetsecurity.com/?p=386873)