The number of credit warnings registered in Denmark has increased by more than 700,000 in just one week, following a major security breach that exposed personal information linked to approximately 8.8 million people in the country’s national civil registration system.
According to figures from the Ministry of Science, Higher Education and Digital Affairs reported by TV 2, around 970,000 people had registered a credit warning by 7 October, compared with approximately 250,000 on 1 October, before the breach was publicly disclosed. The total has therefore nearly quadrupled.
Minister for Science, Higher Education and Digital Affairs Christina Egelund welcomed the response, telling TV 2:
“It is very good that Danes are protecting themselves against fraud in this way.”
How Denmark’s credit warnings work
A credit warning (kreditadvarsel) is a voluntary safeguard linked to a person’s identification number in Denmark’s Civil Registration System (Det Centrale Personregister, CPR).
The system assigns residents a unique ten-digit number used in interactions with public authorities and private businesses, including banks.
According to Denmark’s official public information portal, registering a credit warning signals to lenders that they should conduct additional identity checks before approving a loan or other forms of credit.
The measure is intended to reduce the risk of identity theft, particularly when criminals attempt to obtain financial services using someone else’s personal information.
However, a credit warning does not automatically prevent loans from being issued. Companies can choose whether to receive these notifications, and registering one may also make it more difficult for the legitimate holder to obtain credit.
Following the breach, Danish cybersecurity authorities advised people with concrete suspicions of identity fraud to register a warning. They also urged residents to remain alert to suspicious emails, text messages and telephone calls.
Questions remain over the security of Denmark’s CPR system
The increase follows the disclosure on 5 October that unauthorised individuals had exploited a private Danish company’s legitimate access to the national register over approximately ten days in September.
According to the CPR administration, the incident involved access to names, addresses, CPR numbers and other personal information relating to around 8.8 million registered individuals. This figure includes people who have died or moved abroad, rather than only current Danish residents.
The company’s access has since been suspended, while police and data protection authorities investigate the incident.
Denmark’s Data Protection Agency has stressed that a data breach does not necessarily mean personal information has already been misused. However, stolen personal details can make phishing attempts and other forms of fraud appear more convincing.
Meanwhile, the Danish government has launched a broader security review of the CPR system. On 8 October, Egelund told the Ritzau news agency that she expected to provide more information on its future soon.
The review could determine whether additional safeguards are sufficient or whether more substantial changes are needed. The possibility of issuing new CPR numbers has been raised, but no decision has yet been made.
