Denmark's Population Register Breach: What Can Iceland Learn?

On 5 October 2026, Danish authorities announced a major security incident involving the country’s Central Person Register (CPR), which exposed personal information associated with approximately 8.8 million registered individuals.¹

The exposed information included names, addresses, and CPR identification numbers (comparable to the Icelandic kennitala). The system contains records for approximately 11 million individuals. This exceeds Denmark’s current population of around 6 million because it also includes deceased individuals and people who have emigrated.

This data breach raises interesting and important questions regarding the security of national population registers; which is especially relevant in countries such as Iceland, where similar systems are fundamental to everyday life (Iceland.is rafræn skilríki, among others).

How did it happen?

Interestingly, the attackers did not require direct access to the central registry; rather, they exploited the legitimate access of a private Danish company to the CPR system. According to Denmark’s Data Protection Agency (Datatilsynet), an abnormally high number of automated queries were made, apparently attempting to identify valid CPR numbers.² Subsequent reporting revealed that approximately 14 million queries were made over roughly ten days in September.³

Most surprisingly, the activity reportedly came to the authorities’ attention not through a normal security alert, but instead because of an abnormally large invoice generated by these queries.³

On 9 October 2026, the Danish IT company Pays ApS confirmed that its access had been misused. The newspaper Politiken also reported that several company accounts had used the password 123456, while an individual claiming responsibility described accessing the system using leaked credentials from a former employee.⁴

The precise circumstances of the intrusion and the attack methods used remain under investigation at the time of writing.

What about Iceland?

Iceland operates a comparable national population register, maintained by Þjóðskrá Íslands (Registers Iceland).

Like the Danish CPR system, Iceland’s population register contains personal information, including names, addresses, national identification numbers (the kennitala), and other registration details.

Similarly, Icelandic legislation allows authorized third parties to access population-register information.

Under Article 12 of Iceland’s Act on the Registration of Individuals (No. 140/2019), sharing information from the population register requires authorization and may be conducted through contractual arrangements with approved intermediaries. The law generally doesn’t allow sharing the entire register, but there are some specific exceptions.⁵

This does not imply that Iceland’s population register suffers from the same vulnerabilities as Denmark’s. Rather, the incident in Denmark demonstrates a security problem relevant to any system that provides external organizations access to large amounts of personal information.

Just securing the central database isn’t enough if authorized access to that database can be misused.

For Iceland, the incident raises several general questions worth considering:

• How effectively can abnormal access patterns be detected?
• Are organizations restricted to accessing only the information they actually need?
• Could it be possible to limit automated queries to prevent large-scale data collection?
• What safeguards are in place if an authorized organization’s credentials are compromised?

The risks of exposed personal information

National identification numbers are particularly problematic when exposed because they are persistent identifiers that cannot easily be replaced.

Although knowing someone’s CPR number/kennitala does not automatically grant access to their accounts, if a malicious actor were to combine that information with names and addresses, it could make their phishing attempts and identity impersonation much more convincing.

The Danish authorities have warned citizens not to disclose confidential information to callers or email senders, even when those individuals appear to know their personal details.¹ The same principle applies in Iceland, where CERT-IS has previously warned about phishing campaigns that attempt to trick individuals into authorizing actions using their electronic identification credentials.⁶

Lessons from the breach

The incident in Denmark shows the importance of applying cybersecurity principles beyond just the boundaries of an individual organization.

The risks associated with third-party access can be mitigated with things such as strong authentication, appropriately restricted access permissions, rate limiting, and monitoring for unusual activity.

Perhaps the most important lesson is that legitimate access does not necessarily mean legitimate activity. Proper authorization depends on proper authentication.

As national services become increasingly interconnected, the security of sensitive information depends not only on the organizations maintaining that information, but also on everyone authorized to access it.