An unidentified party used a company’s legitimate access to pull 8.8 million records from Denmark’s Central Population Register.
In early October 2026, Danish authorities disclosed that an unidentified party had misused a private company’s approved access to Denmark’s Central Population Register (CPR) to extract approximately 8.8 million personal records. The intruder did not necessarily need a vulnerability to get in. They appear to have used access that an approved company already held. The activity reportedly began in September before CPR administrators spotted it on October 2.
How Approved Access to Denmark’s National Registry Was Abused
The CPR is Denmark’s national civil registry, with about 11 million records. The 10-digit CPR number assigned to each person works much like a Social Security number. Danish law lets private companies with a legitimate interest look up specific individuals on the registry.
An unidentified party appears to have abused that arrangement by using a private company’s legitimate access to Denmark’s CPR to extract 8.8 million personal records. The exposed data includes names, addresses, CPR numbers, and each person’s status (living, emigrated, or deceased). The party reportedly stayed within the information types private companies may retrieve, so each query appeared to be allowed.
According to BleepingComputer, the CPR administration noticed irregular activity on October 2 and notified the Danish Data Protection Agency on October 4. The CPR administration disclosed the incident on October 5. Authorities have cut off the company’s access, opened a police investigation, and set up a hotline for affected citizens.
Approved Access Is Still Third-Party Risk
From the registry’s perspective, the company that accessed the data was a third party. Access to the CPR made sense at the time of approval, but permissions must be continually re-examined to catch misuse early.
The stolen data carries real downstream risk. Threat actors can combine names, addresses, and national ID numbers for social engineering and identity fraud.
The risk also extends beyond Denmark and this particular incident. Any organization that grants vendors access to sensitive information could face similar exposures. Third- and fourth-party relationships have expanded the attack surface in recent years, giving attackers a trusted, ready-made entry point that bypasses an organization’s own defenses.
And the data shows that attackers are taking note: 48% of breaches now stem from third-parties, according to Verizon’s 2026 Data Breach Investigations Report — a figure that’s up 60% from the previous year.
From Periodic Reviews to Continuous Vendor Risk Monitoring
Third-Party Risk Management (TPRM) programs usually ask who has access to their data. The better question is whether vendors use that access as expected, every day. A vendor can pass its January review, suffer a credential compromise in March, and expose millions of records before the next cycle. Continuous monitoring shrinks that gap from months to days by treating vendor risk as a live signal.
You cannot monitor access you do not know exists. Inventories often miss shadow IT, subsidiaries, and fourth parties. Here’s what to do this week to assess your supply chain risk:
- Inventory every vendor with direct access: Include API keys and service accounts as well as user logins.
- Tier vendors by data sensitivity: Implement tighter policies for those who can query or export personal records.
- Set expected behavior per tier: Use query volume, hours, and rate limits, and alert on deviations.
- Monitor vendor posture continuously: Monitor for vendors holding your most sensitive data.
- Enforce least-privilege access: Assign vendors role-based permissions scoped to their work and require owners to recertify that access on a regular schedule.
- Rehearse the response: Determine who contacts the vendor, who governs access, and who notifies regulators.
Regulators already expect incidents of this kind. The European Union’s Digital Operational Resilience Act (DORA) and Network and Information Security Directive 2 (NIS2) both push for ongoing supplier oversight and fast incident reporting, and boards increasingly want evidence, not just assurances.
Visibility Starts With Knowing the Ecosystem
The CPR breach demonstrates that third-party risk does not always begin with a vulnerability. It can begin with access that nobody re-examined. Teams that catch misuse early know every vendor in their ecosystem, set policy by data sensitivity, and monitor continuously against it. Annual reviews still have a place, but they cannot carry the whole program.
See how SecurityScorecard’s TITAN Watch and TITAN Secure provide continuous vendor visibility and policy-driven monitoring. TITAN Watch gives teams a baseline by combining security ratings, continuous monitoring, and questionnaires. With TITAN AI, you can automatically detect unknown vendors and map third- and fourth-party relationships. Visibility alone produces long lists. SecurityScorecard’s TITAN Secure lets you define a standard and shows which vendors fall short first.
Request a demo to see which vendors with access to your data fall short of your standard today.
