Denmark Confirms Massive Breach of National Citizen Database Affecting 8 Million Records
Denmark's Central Person Register, a government database containing personal information on citizens, was breached in September with the theft discovered on October 2, affecting approximately 8 million people's records including names, addresses, and government ID numbers. The unauthorized access was obtained by exploiting a Danish company's legitimate access credentials to the system, marking what authorities believe to be the largest data breach in the country's history. The breach follows a pattern of similar attacks on national identity databases globally, including previous incidents in Turkey and India.
Denmark's government disclosed a significant intrusion into its Central Person Register during early October, revealing that criminals had gained entry in September. The database serves as the official repository for identification details across Denmark's population and extends beyond current residents to encompass historical records spanning multiple decades. Attackers obtained access by exploiting credentials legitimately held by a private Danish company that maintains authorized query permissions within the system.
This incident fits within a broader pattern of coordinated targeting of national identity infrastructures. Similar compromises have affected citizen databases in Turkey and India in recent years, suggesting organized adversaries view government identity systems as high-value targets. The scale—affecting records exceeding Denmark's current population—underscores the extensive historical data accumulated within such centralized registries.
The breach potentially exposes millions to identity theft, financial fraud, and targeted phishing campaigns leveraging sensitive personal identifiers. Citizens may face increased vulnerability to scams referencing their government ID numbers and residential addresses. Organizations and individuals affected could experience elevated costs for credit monitoring and identity protection. The incident may prompt regulatory review of private company access protocols to sensitive government systems and influence public confidence in data security practices across both government and private sectors.