Hackers Stole 8.8 Million Unchangeable Government ID Numbers From Denmark's National Registry

The Breach That Didn't Need to Hack Anything

Denmark's Central Person Register, the CPR, is the spine of Danish civic life. It holds the name, address, birth date, marital status, and permanent national ID number for every person registered in Denmark. That ID number, your CPR number, follows you from birth to death. You use it to open a bank account, access healthcare, file taxes. No government agency will ever issue you a new one. It cannot be changed.

On October 5, 2026, Danish authorities announced that 8.8 million records from that database had been stolen. The breach itself happened in September. Irregular behavior was detected October 2. Three days later, the public found out.

How Did They Get In Without Breaking In?

Here is the part that matters most: attackers never exploited a flaw in the CPR database itself. They didn't crack government servers or find a zero-day vulnerability. They used legitimate credentials belonging to a private Danish company that had been granted authorized access to the registry.

Once inside, they didn't just grab whatever was in front of them. They enumerated. CPR numbers follow a predictable structure, so attackers systematically brute-forced through number sequences, pulling record after record at scale. This technique is called enumeration. It turns authorized access into a data vacuum.

This is the soft underbelly of every secured government system: the third parties around it. You can build the most hardened database in the world, but you cannot make it more secure than the weakest business you allow to connect to it. The CPR database didn't fail. The perimeter around it did.

What Got Taken, and Why It's Worse Than a Password Leak

8.8 million records. That's roughly 80% of the 11 million entries in the system. Living citizens, Danish expats abroad, and deceased people all included.

Each record contained:

• Full legal name
• Home address
• CPR number
• Birth date
• Marital status

Now compare this to a typical data breach where passwords leak. A stolen password is annoying. You change it in five minutes. A stolen CPR number is permanent. There is no reset. There is no "change your national identity number" button. Every person in this dataset will carry compromised data for the rest of their lives.

Danish authorities confirmed the stolen data alone cannot bypass MitID, Denmark's two-factor authentication system used for banking and government services. That is good news, and it matters. But it doesn't neutralize the threat.

What this data enables is something arguably more dangerous than account takeover: convincing impersonation. A fraudster calling you as your "bank" would already know your exact full name, your address, your national ID number, and your date of birth. That's enough to sound completely legitimate. That's enough to manipulate you into handing over the piece they're missing.

Minister of Digitalization Christina Egelund called it "a deeply serious incident." Police and the Danish Data Protection Authority have both opened investigations.

What Should You Do Right Now?

If you are in Denmark or have ties to Danish records, treat this as active. The risk isn't hypothetical.

1. Be suspicious of any unsolicited contact. Phone calls, emails, or texts from "your bank," "the government," or "a healthcare provider" should get immediate skepticism. Attackers now have enough information to make those contacts sound real.

2. Verify before you act. If someone calls claiming to be from your bank and asks you to confirm details or take urgent action, hang up. Call the official number on the bank's website directly.

3. Enable MitID two-factor authentication everywhere it's available. Authorities confirmed MitID cannot be bypassed with this data alone. Keep it on. Don't turn it off for convenience.

4. Watch your accounts. Check your bank statements more frequently over the next several months. Look for unfamiliar transactions, new accounts opened in your name, or changes to your address on file.

5. Report phishing attempts. If you receive a suspicious message, report it to your bank and to the Danish Data Protection Authority. The more reports they receive, the better picture investigators get of how the stolen data is being deployed.

6. Talk to people who might be vulnerable. Older relatives and people less familiar with phishing tactics are the most likely targets for social engineering campaigns built on this data.

The Systemic Problem That Won't Go Away

There is a pattern here that repeats across industries, governments, and borders. The most secure systems in the world are routinely compromised through the organizations around them rather than through the systems themselves. A hospital network breached via a billing vendor. A defense contractor exposed through a software supplier. Denmark's national registry accessed through a private company with a legitimate key.

You cannot outsource access without outsourcing risk. Every organization that touches sensitive data becomes part of the attack surface, whether they know it or not.

For governments specifically, this creates a near-impossible problem. Modern civic infrastructure requires third-party access. Healthcare providers need CPR lookups. Banks need to verify identities. You cannot run a functional society on an air-gapped database. But every connection is a potential entry point.

The harder truth is that immutable identifiers are a design flaw hiding in plain sight. When the credential that organizes your entire civic life cannot be rotated, the consequences of any breach become permanent. Denmark is not unique in this. Most countries built their identity infrastructure before the modern threat landscape existed.

Do this now:

• Treat unsolicited calls or messages with automatic suspicion for the foreseeable future
• Verify any urgent contact by calling official numbers yourself
• Keep MitID two-factor authentication enabled
• Check bank and government accounts for unusual activity
• Pass this warning to anyone in your life who might not see it

Sources

• bleepingcomputer.com
• cybernews.com