About 8.8 million records were read out of Denmark’s population register through one company’s lawful access, and the only thing counting the queries was the billing run. Most partner data access is metered the same way.
—
On the evening of Friday 2 October 2026, the administration of Denmark’s Central Register of Persons (CPR) became aware of irregular activity in the register during September. Over the weekend it established the scale: unauthorised persons had obtained names, addresses and CPR numbers, the national personal identification number, for approximately 8.8 million registered people. The register holds about 11 million records, because it also covers the deceased and people who have moved abroad. Roughly four fifths of a national population register had been read out.
The route in was not a break-in. The ministry’s press release of 5 October (in Danish) says the access took place “by unauthorised persons using a private Danish company’s lawful access to search for information in the CPR system, within the scope of the information that private companies have access to” (translated). Private companies with a legitimate interest are entitled by law to CPR information about people they have identified individually in advance. The company’s access has been stopped, the Danish Data Protection Agency has been notified, and police are investigating. The company has not been named, and it is not public who was behind the queries or how they came to use its access.
Here is the signal worth acting on. The register did have one mechanism that counted every query: the billing meter, because companies pay for each lookup. It worked. It reported to invoicing, on a monthly clock, so the first thing to notice four fifths of a national register being read out was a bill. That is the general lesson, well beyond Denmark and beyond government. When an organisation gives partners, customers or suppliers query access to its data, it governs who may ask and which fields they may see. Far fewer govern how much will be served, and how fast, before a person looks. In many organisations the only function that actually measures partner consumption is whoever raises the invoice, and it measures on a billing cycle, not a detection cycle. The usage meter is a security control reporting to the wrong function on the wrong clock.
What the meter saw
The Next Web, reporting an official briefing on 6 October, says the company’s account made well over 14 million lookup attempts over ten days in September, of which 8.8 million returned a record. That is an average of more than 1.4 million attempts a day. Mikkel Leihardt, a department head at the ministry, described the moment of discovery: “I can confirm that it is during invoicing on Friday evening that a very, very large amount is billed, which alerts you that there has been very large activity during September.”
DR, the Danish public broadcaster, reported that neither automatic alarms nor spot checks led to the discovery, which the authorities then confirmed. Jacob Herbst, who chairs Denmark’s Cybersecurity Council, told DR: “It seems too random that it is an employee doing invoicing who discovers a huge breach” (translated). DR also reported that the department head, asked who had been responsible for monitoring the system, declined to answer.
There is a second signal in the same meter. Well over 14 million attempts with 8.8 million records returned means more than 5 million attempts returned nothing. A customer entitled to look up people it has already identified individually should rarely miss. The public account does not describe how the queries were constructed, and police say it is too early to describe the method, so this is not a finding about the attacker. It is the kind of pattern a usage review exists to ask about.
The entitlement was written per record, but volume was limited in practice only by terms and by price. Guidance from DI Digital, the digital arm of the Confederation of Danish Industry, sets out what the register’s published standard terms for system-to-system access expect of a private recipient. The register usually sees only the company’s single system user ID, so only the company’s own log can show who performed a lookup. The company’s security officer checks a monthly transaction statistics report. Mass lookups through the online access are not permitted. (It is not public which access route the affected company used.) A prohibition on mass lookups in the terms is a promise by the partner, not a limit in the system. DI’s own verdict: “if the bill is the first sign of misuse, it is too late” (translated).
Three numbers that need an owner
For each credential that lets an outside party query the organisation’s data, three numbers should exist and have a named owner. The first is the volume the partner’s stated purpose would explain. The second is the volume the system will serve before anything intervenes. The third is the time before a person would notice the gap between the first two. In Denmark, nothing in the public account suggests the second was bounded short of 14 million attempts, and the third turned out to be the wait for September’s invoice.
This is the same shape as the cloud wipe that took seven minutes and was decided months earlier, where a compromised machine identity deleted most of the storage it targeted using only the roles it already held. A legitimate credential acting inside its granted permissions makes the size of the loss a design decision taken long before the incident. The partner’s security decides how likely misuse is. The data owner’s volume ceiling decides how large it gets.
The exposure also runs in a second direction, and most third-party risk programmes look at only one. Almost every company holds query access into someone else’s system: registries, credit and identity checks, a customer’s platform, a bank interface. In that relationship the company is the small Danish firm. DI’s opening line to its members is “Your CPR access is a key that others would like to have” (translated). The provider typically sees one system credential, so only the holder’s own logs can show who or what used it. DI notes that this is the second case in less than a year: in December 2025 a payroll platform’s demo account was used for unauthorised lookups of nearly 90,000 CPR numbers. A demo account was enough.
Two consequences landed on parties who had done nothing wrong. According to DI, every private company’s access to the register was closed temporarily and reopened on 5 October: a data owner that cannot quickly tell whether other credentials are behaving the same way is left with the bluntest lever available. And the authorities now tell organisations to stop treating knowledge of a CPR number as proof of identity. “You cannot use it to authorise things, to buy something or to get sensitive personal information,” said Laila Reenberg, who leads Denmark’s agency for civil security, as quoted by The Next Web. Any process that authenticates a caller by what the leaked record contains has lost that control.
What senior management should consider
Boards and audit committees: which partner credentials have a volume ceiling enforced in the system, not just promised in a contract, and who owns it? CISOs and CIOs: does usage telemetry reach anyone on a detection clock, or only finance on a billing clock? Data protection officers: what does each lawful access route make reachable at scale, and is that proportionate to the purpose it was granted for? Owners of partner and API platforms: can activity under one credential be attributed to a person, or only to a company? Finance and billing operations hold the meter, and should know that an anomalous usage figure is a security event and who to call. Third-party risk and procurement own the mirror question: which external credentials does the organisation hold, what is logged at this end, and what would misuse of one look like from the provider’s side?
Setting the ceiling is the hard part, and it cannot be read off a dashboard by an outsider or chosen by the platform team alone. What a normal month looks like for a given partner is known by the people who own the commercial relationship. What the interface can enforce is known by the engineers who run it. What misuse has looked like elsewhere is known by an analyst who has seen it. A ceiling set by all three neither blocks legitimate business nor serves a whole register. On the public account, Denmark’s rules said who could ask and what they could see. What the system did not have was a number.