Denmark population registry data breach affects 8.8 million people

Threat actors abused a private company's legitimate access to Denmark's Central Population Register (CPR) to enumerate and exfiltrate personal data on 8.8 million individuals using CPR number brute-forcing. The root cause is a failure to enforce granular, least-privilege access controls on a highly sensitive national database, combined with the absence of anomaly detection to flag bulk enumeration attempts. Allowing a third-party vendor unrestricted or overly broad query access to a national registry without rate limiting or behavioral monitoring created a catastrophic single point of failure. This breach matters because CPR numbers are permanent national identifiers used across Danish society — unlike passwords, they cannot be reset — making the long-term identity fraud risk severe and irreversible.