Hackers Take 8 Million Danish Citizens' Records, Including the Dead

Hackers have stolen the records of 8 million people from a Danish government database, the Danish government said. The data taken includes names, addresses, and state-issued ID numbers.

The figure is larger than Denmark's resident population because the database covers people living abroad and the deceased.

Why that last detail is the important one

A breach is usually described by how many living customers it touches. This one is best understood by what it says about a national identity register: the records do not expire when a person leaves, or dies.

That is a design choice, not an accident. Identity systems keep historical records because entitlements, property, inheritance and tax all reach backwards. The security consequence is that the exposure of such a system is permanently larger than its active user base, and that a stolen record cannot be revoked the way a card number can. An address can be changed. A state-issued identity number generally cannot.

The question this puts to Ethiopia

Ethiopia is building out Fayda, its national digital identity scheme, which the Prime Minister cited from the podium this week as one of the pillars of the government's digital programme. The Danish breach is a direct precedent for the risk that creates, and the lesson is not that digital ID is a mistake. It is that the blast radius of a national identity database is the whole register, forever, and that the controls have to be sized to that rather than to the number of people currently using the service.

For banks and fintechs that rely on a national ID for customer onboarding, the practical question is what their fallback is when the identity layer they trust is the thing that has been compromised.

Open

The Danish government has not said which database was breached, how the attackers got in, when the intrusion began, or who is responsible. Nor has it said what remediation is available to 8 million people whose identity numbers cannot be reissued.

Sources: TechCrunch, 5 October 2026