The Danish CPR leak: what it changes for identity monitoring

The CPR leak showed that a Danish identity number is no longer a secret. What that means for partners and what identity monitoring can add.

Soroush Pourhadi

For years, many Danish processes have treated a name, an address and a CPR number as proof of who someone is. In October, that assumption broke. With millions of CPR numbers now in the wrong hands, anyone who calls, writes or applies in someone else's name can sound credible. For banks, insurers and telcos with Danish customers, the question is no longer whether to talk about identity protection, but how to do it honestly.

What happened

On 5 October 2026, the Danish ministry responsible for digitalisation said unauthorised people had accessed names, addresses and CPR numbers from the CPR register. According to the ministry, 8.8 million registered people are affected. The next day, Styrelsen for Samfundssikkerhed asked authorities, organisations and companies to strengthen their identity checks and not to hand out sensitive information on the basis of CPR data alone. In other words, a CPR number can no longer be treated as proof of identity.

Scammers use the news as a door-opener

Within days, Beskæftigelsesministeriet and Finans Danmark warned that scammers were using the leak as a pretext, with texts, emails and calls asking for MitID details. TV 2 reported on a woman whose CPR number had been used to buy goods worth thousands of kroner. A caller who already knows your address and CPR number can easily sound like your bank.

A credit warning is one layer

Danes acted fast: about 700,000 registered a free credit warning (kreditadvarsel) by 8 October, according to TV 2. The same day, TV 2 pointed out that a credit warning can give a false sense of security, because it doesn't cover every way identity data can be misused. That is where an ongoing service can help, as long as it sits on top of the free tools rather than competing with them.

What identity monitoring adds in Denmark, and what it doesn't

This is what Defentry offers in Denmark today:

Dark Web Monitoring: watches email addresses, phone numbers, payment cards, CPR numbers, passports and driver's licences for leaks.
Alerts & Guidance: tells the user when something is found and guides them through what to do.
Online Data: finds personal details on Krak.dk and requests removal.
Safety Pulse: a weekly briefing on public scam and breach warnings.
Scam Check: a Green, Amber or Red assessment of a suspicious email or text.
Insurance: cyber and identity insurance that covers the user financially on the terms of the policy.

Want to talk about what this means for your Danish customers? Get in touch.