On 5 October 2026, Danish authorities announced a serious security incident and data breach involving Det Centrale Personregister (CPR), Denmark’s Central Person Register.
Unauthorised persons gained access to names, addresses, CPR numbers and other information relating to a very large number of people registered in the system.
The Danish Immigration Service and the Danish Agency for International Recruitment and Integration (SIRI) have confirmed that people who use their services may also be affected.
Following the incident, the Danish Immigration Service and SIRI introduced additional identity checks for telephone enquiries to Citizen Service. People contacting the authorities may therefore be asked extra questions before their identity can be confirmed.
Why the CPR number is important
A CPR number is a central part of everyday life in Denmark. It is a personal identification number used across Danish public and private systems.
For international candidates arriving in Denmark, understanding how to use and protect this number is particularly important. Personal information such as a CPR number should not be shared casually through messages, social media, phone calls or with people whose identity cannot be verified.
Why you should be extra careful now
Information obtained through a data breach can potentially be used to make fraudulent calls, emails or messages appear more credible.
Someone contacting you may already know your name, address or CPR number. This does not mean the person is genuinely contacting you from a Danish authority, bank or another organisation.
Sikkerdigital therefore advises people to be especially alert to unexpected contact following the incident.
Extra steps to protect your personal information
Following the incident, Sikkerdigital (In Danish) has asked people to be particularly cautious about attempts at fraud involving their personal information. Its current recommendations include:
- Be cautious about unexpected contact. Pay particular attention to unexpected calls, emails and text messages, even when the sender appears to know personal details about you.
- Do not click unexpected links. If a message appears to come from an authority or organisation, access its official website yourself instead of using the link in the message. You can also contact the organisation through its official telephone number.
- Never share security information. Do not provide MitID information, one-time codes, passwords or payment card details to someone who contacts you unexpectedly.
- Consider a credit warning if fraud is suspected. A credit warning can be registered through borger.dk if there is a concrete concern that a CPR number may be misused.
These precautions are especially relevant for international candidates who are still becoming familiar with Danish authorities, digital services and official communication.
Personal data awareness is part of successful integration
Moving to another country involves more than understanding a new professional environment. Candidates also need to learn how local authorities, banking, healthcare, taxes, identification and digital services operate.
Through the Bixter Academy Cultural Awareness course for Denmark, candidates are introduced to important Danish systems and practical responsibilities that are part of daily life in the country.
This preparation also includes lessons explaining the importance of the CPR number and the yellow health insurance card (sundhedskort). Candidates learn why these are important, how they are used and why personal information linked to them must be handled carefully.
Denmark is highly digitalised, and systems such as CPR and MitID play an important role in everyday life. It is therefore important not only to understand how these systems function, but also how to use them safely.
The recent CPR security incident makes this especially relevant. Understanding how personal information is normally used in Denmark can help candidates recognise unusual requests and know when they should verify who they are communicating with.
The Cultural Awareness course supports this understanding by giving candidates practical knowledge of the systems they are likely to encounter during their integration in Denmark.
What to do if you are unsure
Following this incident, candidates in Denmark should be particularly cautious if they receive unexpected requests for personal or financial information.
If something appears unusual:
Do not click the link. Do not provide additional information. Do not share MitID codes or passwords. Verify the request independently through an official channel.
If you suspect that your CPR number may have been misused, follow the guidance provided by Sikkerdigital. You can also create a credit warning to make it more difficult for someone to obtain credit in your name.
If you need help, for example with setting up a credit warning, you can contact the Danish Agency for Societal Security’s Cyberhotline for Digital Security on 33 37 00 37.
The hotline currently has extended opening hours from 08:00 to 24:00 for the coming days.
For the latest information and guidance, always follow updates from the relevant Danish authorities and Sikkerdigital.
Official information: Read the announcement from Ny i Danmark and read Sikkerdigital’s guidance on protecting your personal information.
