Denmark investigates major hack of national registry exposing millions of records

Denmark has launched an investigation after hackers broke into the country's national registry and obtained personal information for millions of people, the government confirmed.

Officials said the breach affected between about 8 million and 8.8 million records, with different reports citing those two totals. The government has acknowledged the incident and is probing how the attackers gained access.

How the attackers accessed the registry

According to Channels TV, the intruders gained entry by compromising a Danish company that had legal access to the national registry. Channels reported that, as of its coverage, that company's access to the registry had not been revoked. The government's confirmation of the breach was also reported by Punch.

Scope and types of data accessed

TechCrunch reported that the stolen records include names, addresses and state-issued identification numbers, and that the dataset covers people living abroad as well as the deceased. The exact composition of the exposed data and how complete the stolen records are have not been independently confirmed across all reports.

Response and implications

Authorities in Denmark have opened investigations to determine the full extent of the breach and how the attackers obtained access. The situation raises questions about third-party access controls for national databases and the protections in place for citizens' personal information.

What remains unclear

Reports differ slightly on the number of affected records and on the status of the third party's access to the registry. Channels TV says the company’s access had not been revoked at the time of its reporting; other sources did not provide that detail. Punch and Channels both cited the government's confirmation of the breach, while TechCrunch provided additional detail on the kinds of data taken and the inclusion of diaspora and deceased individuals.

Why this matters

National registries typically hold a wide range of personally identifiable information used for public services, identity verification and administration. A breach on this scale could expose affected individuals to identity theft, fraud and other harms, and could prompt scrutiny of both government cybersecurity measures and the procedures that govern third-party access to sensitive databases.

Investigations are ongoing and Danish authorities have said they are working to determine the facts and contain the incident. Further official updates will be needed to clarify the full scope of the exposure and steps being taken to protect affected people.