Personal data of about 8.8 million leaked from Denmark’s central population register after legitimate access abused

Reports say personal data for about 8.8 million people were taken from Denmark’s central population register, CPR. A system that allows private companies to query the CPR for legitimate reasons was abused, and access rights held by a small Odense IT firm, Pays ApS (two employees), served as the entry point.

The intrusion began on 10 September 2026, and by 20 September approximately 14 million automated queries had reportedly been performed. According to the article, that averages to roughly 16 queries per second over the 10-day period. Pays has acknowledged that legitimate access rights were abused.

The breach was discovered when a ministry official found invoices showing an unusually high volume of Pays usage and noticed it on 2 October. It was reported to the data protection authority on 4 October and made public by the government on 5 October. The attack method was not ransomware or AI misuse, but unauthorized extraction through a large number of legitimate authenticated queries.

This incident is a case of data exfiltration from a national-scale database caused by "abuse of legitimate privileges," and highlights the importance of operational monitoring, anomaly detection, and management of access rights granted to third parties. The reporting is based on information currently disclosed; the detailed scope and full impact of the leak await further announcements from authorities and involved parties.