Denmark’s central population register (CPR) was the target of a large-scale data access event: unauthorized parties used a private company’s legitimate access rights to query the register and, according to official statements, obtained names, addresses and personal identification numbers for roughly 8.8 million people. The activity lasted about ten days in September and was discovered by the register’s administration on