Hackers Stole 8 Million Records From Denmark's Central Citizen Database
Names, addresses and national ID numbers were taken from the Central Person Register in what officials call the biggest breach in Danish history.
The Danish government has confirmed that its central database of citizens' data was breached and most of its contents were stolen, in what officials describe as the biggest data breach in the country's history.
The breach affects some 8 million citizens and residents of Denmark, including people living abroad and the deceased, TechCrunch reported. In a statement, Danish minister Christina Egelund said the breach of the country's Central Person Register, known as the CPR, was a serious incident, which allowed hackers to steal names, addresses, Danish social security numbers, and other information.
The CPR is the government database of Danish citizens' information, including the government-issued identity number used for paying taxes and accessing public services. Denmark's current population is about 6 million people, but the database holds records for about 11 million people, with some of the data going back decades.
The Danish government would not say who is behind the breach, which happened in September but was discovered on October 2. Officials said the unauthorized access was obtained by abusing a Danish company's lawful access to search for information in the CPR system. Some Danish companies hold such access for verifying people's information with the government.
A familiar pattern
The breach follows a grim lineage of attacks on national identity databases. In 2016, hackers exposed the personal data of millions of Turkish citizens, and India's national Aadhaar database of more than a billion people has suffered repeated exposures of national ID data over the years.
Centralized identity registers are uniquely attractive targets. Unlike a password, a national ID number cannot be rotated, which means the stolen data retains its value for years. Denmark now faces the long task of monitoring for identity fraud across a population larger than its own.
A bad week for data
The Danish disclosure capped a rough stretch for data security. On October 6, hackers hijacked the ASOS mobile app to send customers a push notification headed "ASOS HACKED," claiming to have compromised the retailer's data platform. ASOS confirmed that names and contact details may have been accessed, though payment cards and passwords were not believed to be affected, and its shares closed down 10.6 percent on the news.
Separately, attackers used an open-source AI hacking agent to break into at least seven South Korean financial firms and steal personal data on about 68,000 people, according to reports citing the Wall Street Journal. South Korea's National Police Agency opened an investigation into what officials describe as one of the first AI-assisted intrusions into the global banking system.
The CPR breach was not even Denmark's only disclosure that week. The Technical University of Denmark confirmed on October 2 that hackers broke into DTUBasen, the university's central identity system, downloading personal data tied to as many as 200,000 current and former users going back more than two decades. Attackers reportedly took over a handful of legitimate accounts and walked straight in, a case study in how a single credential failure can cascade.
The Danish government has not detailed its remediation plan beyond confirming the investigation. Under the EU's GDPR, the breach is likely to draw scrutiny from regulators, and the sheer longevity of the exposed records, some decades old, means the monitoring burden will fall on citizens who may not have interacted with Danish authorities in years. For a country that prides itself on digital-first public services, the incident is a stress test of the trust those services require.
Taken together, the incidents point to an uncomfortable pattern. Attackers are getting faster and more automated, while the databases they target keep getting more central, and more consequential when they fall.