Danish CPR numbers can no longer be used alone for identity verification

You can no longer use your CPR number alone to prove identity in Denmark. Danish authorities announced this rule change after a massive data leak.

Unauthorized parties accessed the CPR register over ten days in September. They obtained name and address data of 8.8 million people. The leak occurred through a small Danish company with system access. Officials noticed the breach when invoicing the company for excessive searches. The database contains details of current residents, former residents, and deceased people.

People in Denmark frequently use CPR numbers at doctors and pharmacies. Public security agency Samsik says CPR numbers cannot authorize sensitive services. Agency director Laila Reenberg stated that receiving a CPR number no longer proves identity. Officials advise using MitID, two-factor authentication, or text message codes instead.

Department head Mikkel Leihardt from the digitalization ministry confirmed a security review. He noted that other sensitive personal data remained safe. Authorities have also strengthened security across critical state IT systems. This report was originally published by CPH Post.