For years, many Danish processes have treated a name, an address and a CPR number as proof of who someone is. In October, that assumption broke. With millions of CPR numbers now in the wrong hands, anyone who calls, writes or applies in someone else's name can sound credible. For banks, insurers and telcos with Danish customers, the question is no longer whether to talk about identity protection, but how to do it honestly.
On 5 October 2026, the Danish ministry responsible for digitalisation said unauthorised people had accessed names, addresses and CPR numbers from the CPR register. According to the ministry, 8.8 million registered people are affected. The next day, Styrelsen for Samfundssikkerhed asked authorities, organisations and companies to strengthen their identity checks and not to hand out sensitive information on the basis of CPR data alone. In other words, a CPR number can no longer be treated as proof of identity.
Within days, Beskæftigelsesministeriet and Finans Danmark warned that scammers were using the leak as a pretext, with texts, emails and calls asking for MitID details. TV 2 reported on a woman whose CPR number had been used to buy goods worth thousands of kroner. A caller who already knows your address and CPR number can easily sound like your bank.
Danes acted fast: about 700,000 registered a free credit warning (kreditadvarsel) by 8 October, according to TV 2. The same day, TV 2 pointed out that a credit warning can give a false sense of security, because it doesn't cover every way identity data can be misused. That is where an ongoing service can help, as long as it sits on top of the free tools rather than competing with them.
This is what Defentry offers in Denmark today:
Want to talk about what this means for your Danish customers? Get in touch.