The Central Person Register (CPR) is Denmark’s civil registration system for core identity data. It stores information such as a person’s name, address, and CPR number, a unique government identifier used across public services. In security terms, this makes the CPR a high-value identity registry: if the data is exposed, it can help attackers link records across systems and build convincing profiles of real people.
CPR data matters because it is difficult to “reset” an identity number the way you would a password. Leaks can support impersonation, targeted phishing, account takeover attempts, and fraud that relies on accurate personal details. Defenders therefore treat access to such registries as sensitive infrastructure. Important controls include strong authentication, least-privilege access, logging, anomaly detection, and alerts for bulk lookups or unusual exports. Data minimization also helps, because the less identity data stored or exposed, the smaller the attack surface.