Denmark’s CPR Data Breach Exposes 8.8 Million Records

Denmark’s Central Person Register, known as CPR, announced Monday that hackers had obtained personal information belonging to about 8.8 million living and deceased people.

The incident was discovered Friday after the register was alerted to unusual activity in its system during September. A review over the weekend found that the exposed data included names, addresses and CPR numbers, which are Denmark’s equivalent of Social Security numbers.

People who had registered for name and address protection were not affected, according to the national registrar. CPR ended the private company’s access after discovering the breach and notified Denmark’s Data Protection Agency, police and other authorities.

The identity of the hackers has not been established. CPR is reviewing its security policies and plans to strengthen protections against similar incidents. It urged people to be cautious about unsolicited messages requesting personal information, passwords or other sensitive data.

Established in 1968, CPR is Denmark’s national civil registration system. It holds information on about 11 million people, including current residents, emigrants and deceased individuals.

Danish law allows private companies with a legitimate interest to access CPR data about specific individuals. Companies may also request information under Denmark’s Data Protection Regulation and Data Protection Act.