Denmark, hacked.

On the evening of Friday 23 October 2026, 3 Danmark said unauthorised parties may have had access, through an API, to the first names, last names and addresses of its private customers. The investigation covers about 400,000 customers, though it is not yet established that all are affected; the access has been blocked and authorities notified. 3 said the incident most likely poses no risk to customers and is unrelated to the PHP vulnerabilities disclosed the same week.

Hackers got into one of the University of Copenhagen's test environments and a database holding full names, CPR numbers, phone numbers and private email addresses of about 525,000 people; the attack was detected on Tuesday 20 October 2026 and brought under control. KU disclosed it on 23 October, reported it to the Data Protection Agency and said day-to-day operations were not affected.

A hacker gained access to one of Aarhus University's servers and tried to access and change the passwords of about 1,700 users; the intrusion was detected on Monday 19 October 2026 before the changes succeeded. AU said there was no indication that sensitive or confidential data had leaked.

On Sunday 18 October 2026 the department store chain Magasin detected unauthorised activity after outsiders gained access to parts of its IT systems. On 21 October it notified nearly two million members of its Goodie loyalty club that names, addresses and purchase history may have been stolen; card details were not affected and the attackers have not been identified.

In the night to Monday 12 October 2026 a cyberattack hit the IT systems of FLC, main contractor on the Femern Belt tunnel between Denmark and Germany, knocking out site systems including the guards' access control and leaving construction vessels idle off Rødbyhavn. Sund & Bælt said work had partly resumed by 16 October; the National Special Crime Unit (NSK) is investigating and no perpetrator has been named.

Over a weekend in early October 2026 Cimbria, which makes equipment for the food industry in Thisted, was hit by an IT outage that CEO Lars Dithmer said was confirmed to be a cyberattack. The IT department shut down systems, and sales and deliveries continued with some tasks handled manually; the attackers have not been identified.

On 15 September 2026 an unknown actor used a compromised external guest account to attack DTU's identity management system DTUBasen, gaining extended admin rights and extracting a large amount of data on 18 September before DTU detected and stopped the attack on 20 September. DTU went public on 2 October and said data on all of its roughly 200,000 active and inactive users, potentially including CPR numbers and home addresses, may have leaked.

From 10 September 2026 an attacker abused the legitimate access of a small Funen company, Pays ApS, to the Central Person Register, running about 14 million automated lookups and extracting names, addresses and CPR numbers of about 8.8 million people. The CPR administration became aware on 2 October and the government disclosed the breach on 5 October; Pays confirmed its access was exploited, while a suspected hacker's claim that the account used the password "123456" has not been officially confirmed.

A malicious actor attacked a local building network at Hvidovre Hospital used to control and monitor its technical installations, in an attack that was stopped on 1 August 2026. Patient treatment was not affected, but Region Hovedstaden warned about 7,600 employees that names, job titles, usernames and CPR numbers from the access card system may have been accessed; the region declined to say who was behind it.

Novo Nordisk disclosed on 11 June 2026 that an unauthorised party had accessed internal IT systems, forcing it to temporarily shut some down while core business ran normally; Version2 had reported that Novo abruptly cut IT staff's access to GitHub and Azure DevOps on 11 May and was rebuilding its development environment. Novo later confirmed exposure of pseudonymised clinical trial data, while the extortion group FulcrumSec claimed to have stolen 1.3 TB and said Novo refused a USD 25 million ransom (unverified).

In the night to Monday 8 June 2026 a cyberattack hit the National Museum's servers, which were all shut down as a precaution; several IT systems and the Museum of Danish Resistance's audio systems were knocked out. A group calling itself The Gentlemen, described by Ingeniøren as Russian hackers, claimed the attack and threatened to publish data, and the museum later warned that files with personal data on staff and collaborators from the past three years had been accessed.

Lejre Municipality disclosed on 18 May 2026 that a hacker group had broken into a system at Aldente, the IT supplier holding its municipal dental care records, exposing names, addresses and CPR numbers of about 23,000 current and former residents, including children; the municipality had been notified on 1 May. Days later Frederikssund Municipality warned that a breach at a dental care supplier had put residents' personal data online.

A breach at Instructure, the US supplier of the Canvas learning platform known at the University of Copenhagen as Absalon, put data on more than 200,000 people linked to KU at risk, and CBS and Tietgenskolen said they were also affected; KU had reported the breach to the Data Protection Agency on 5 May. On Thursday 7 May 2026 KU users trying to log in were met with an extortion message from ShinyHunters, which defaced Canvas login portals at about 330 institutions, claimed the earlier Instructure breach and gave a deadline of 12 May.

From 23 February to 1 March 2026 the pro-Russian group NoName057(16) ran a coordinated DDoS campaign in which Denmark was the main target; SOCRadar counted about 2,750 attack entries against Danish sites including ports, Energinet, Ørsted, the Ministry of Defence and municipalities such as Horsens, Gentofte and Roskilde. The Port of Kalundborg confirmed its website was knocked offline for about three hours on Tuesday 24 February.

From late January to mid-February 2026 Russia-based hackers hit around 40 websites of Danish ministries, municipalities and businesses, mostly with DDoS attacks; on 3 February the Foreign Ministry's site was down for three hours and Rejsekort.dk for five, while Domstolsstyrelsen, Hillerød Municipality and Danfoss were also targeted. Several groups, including NoName057(16), were reported to be behind the wave.

On Thursday 15 January 2026 the Akira ransomware group encrypted the IT systems of the Danish travel search engine Travelmarket, having got in through a vulnerability in its cloud backup and stolen 15 GB of internal data, and demanded a multimillion-kroner ransom. A technical error damaged the attackers' own decryption tool, and director Ole Stouby told Version2 the company restored its systems without paying; Akira listed Travelmarket on its leak site on 3 February.