Danish CPR Breach Exposes 8.8 Million Records via Corporate Credential Abuse

Det Centrale Personregister confirmed the incident occurred through misuse of an authorized commercial query interface. Attackers extracted core identity fields but did not reach records protected by name-and-address shielding. CPR administration immediately revoked the company's access and notified Datatilsynet plus police investigators.

Registry logs show the intrusion spanned multiple months before detection. The 8.8 million figure covers nearly the entire Danish population plus some non-residents. No evidence indicates bulk export of shielded data or direct exfiltration of protected attributes.

This event follows documented patterns of credential chaining in Nordic government registries, where commercial intermediaries become single points of failure. As AI systems increasingly ingest public-sector identity data for training or verification, such exposures create durable attack surfaces that persist beyond any single breach notification.

Investigation outcomes will determine liability under GDPR Article 32 and potential administrative fines. Regulators are expected to mandate stricter API logging and zero-trust segmentation for all commercial CPR access within six months.