The Denmark data breach has exposed the names, addresses and CPR numbers of approximately 8.8 million people after unauthorized users exploited a Danish company's legitimate access to the country's Central Person Register (CPR), according to the Danish government. The CPR administration became aware of irregular behavior in the system on October 2, after identifying activity that had occurred during September. An investigation found that unauthorized individuals had used a private Danish company's legal access to search the CPR system and obtain information on millions of registered people. The CPR currently contains information on approximately 11 million registered people, including those who are living in Denmark, people who have moved abroad and deceased individuals.

Denmark Data Breach Involved Legitimate CPR Access

The Denmark data breach did not result from unauthorized access being granted directly to the attackers. Instead, unauthorized users abused a private company's legitimate access to the CPR system. Under Section 38 of Denmark's Civil Registration Act, private companies with a legitimate interest can receive information from the CPR about specific groups of people they have individually identified in advance. Companies must also be entitled to receive the information under the General Data Protection Regulation and Denmark's Data Protection Act. The investigation found that unauthorized individuals used this legitimate access to retrieve information from the register. The exposed information includes names, addresses and CPR numbers, which serve as personal identification numbers in Denmark. The CPR administration said the unauthorized access did not include the names and addresses of people who had registered for name and address protection.

Investigation Into CPR Data Breach Continues

The CPR administration has stopped the company's access to the system and is working with specialists and relevant authorities to establish how the incident occurred. The case has been reported to the Danish Data Protection Authority, while police are investigating in cooperation with other relevant authorities. Authorities said the investigation remains in its early stages, and it is not yet possible to identify who was responsible for the unauthorized access. The CPR administration also warned that further investigation could lead to changes or clarification of the information currently available about the incident. Denmark's Minister of Research, Education and Digitalisation Christina Egelund described the incident as serious and said a thorough security review of the CPR system would be conducted. Additional measures have also been launched to prevent similar incidents.

What the Denmark Data Breach Means for Citizens

Authorities have reminded citizens not to provide passwords or other confidential information during phone calls or email exchanges, even when the person making contact appears to know their name, address or CPR number. Guidance is available through Denmark's Sikker Digital service, while the Cyberhotline for digital security has extended its opening hours from 8 a.m. to midnight in the coming days. The incident also highlights the risks associated with legitimate access to sensitive databases. In this case, the access used to obtain the information was originally available to a private company under Denmark's existing rules for accessing CPR data.

Cybersecurity Awareness Month Puts Data Protection in Focus

The Denmark data breach comes during October's Cybersecurity Awareness Month, a period focused on improving awareness of digital security risks. The incident highlights why protecting access to sensitive personal information remains an important part of cybersecurity. For organizations handling large volumes of personal data, the case also shows the importance of monitoring legitimate access and identifying unusual activity. However, Danish authorities have stressed that the investigation is still underway and that the full circumstances of the incident have yet to be established.

Google is limiting access to Gemini 4 Argon, its new artificial intelligence model capable of autonomously finding, validating and patching critical software vulnerabilities, to a vetted group of cybersecurity experts. The restricted rollout is intended to give defenders access to the model's capabilities while Google strengthens safeguards against potential misuse by malicious actors. Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google, announced the model on September 30, 2026. Google is initially distributing it through its Fairwind Program and plans to expand access after gathering feedback from trusted testers and refining its security measures. The decision puts the focus on a central cybersecurity challenge: AI that can help security teams identify and fix weaknesses could also provide capabilities that attackers might misuse to discover and exploit vulnerabilities.

Gemini 4 Argon Discovers Critical Software Vulnerabilities

Google says Gemini 4 Argon can identify, validate and patch vulnerabilities across complex software environments. Its reported capabilities include examining codebases, identifying potential exposures and producing evidence to validate security weaknesses. In an early deployment, cybersecurity company Wiz used Argon through its Scan for Good initiative, which focuses on identifying and remediating high-risk exposures affecting critical public infrastructure. According to Google, the model discovered a critical vulnerability that exposed sensitive personal information in healthcare software used by hospitals worldwide. The company said previous frontier AI models had missed the issue but did not publicly identify the affected software or provide technical details about the flaw. On CWE-bench v1, a benchmark designed to evaluate vulnerability remediation, Argon tied for first place with a score of 68%. Google also reported improvements over its earlier 3.8 Flash Cyber model in internal testing. On Wiz's internal black-box penetration testing benchmark, Argon performed better at identifying attack surfaces, discovering vulnerabilities and generating proof-of-concept evidence to validate its findings. These results are based on Google's and its partners' reported evaluations. They do not establish how reliably the model will identify vulnerabilities across every real-world environment.

Why Google Is Limiting Access to Gemini 4 Argon

Google is taking a phased approach because the model's advanced capabilities require additional safeguards before wider deployment. For defenders, automated vulnerability discovery could help identify weaknesses earlier and reduce the time needed to investigate and remediate them. However, similar capabilities could also be misused to locate weaknesses in systems that attackers want to compromise. Google said trusted cyber defenders and its own internal teams will receive access to Argon without cyber-specific guardrails so they can use its full defensive capabilities. The company is also participating in the US government's voluntary process for pre-release AI model access. Google has not announced a specific date for general availability. It said it will continue evaluating feedback from early testers while strengthening protections against misuse.

Prompt Injection Attacks Among Key Security Concerns

Google has identified several areas where it is strengthening safeguards before expanding access to Gemini 4 Argon. One is prompt injection attacks, in which malicious instructions hidden in external content attempt to manipulate an AI model's behavior. Google said Argon demonstrated improved resilience against indirect prompt injection on Gray Swan's Indirect Prompt Injection benchmark. The company is also testing protections against requests that could facilitate cyberattacks or the development of chemical, biological, radiological and nuclear threats. Google said internal and external red teams assessed these safeguards using manual and automated attack methods. Additional measures monitor the model's reasoning and actions for potential misalignment, with mechanisms designed to stop execution when necessary. Google is also hardening isolated testing environments used for high-risk training and evaluations. These measures are intended to reduce risks, but the announcement does not establish that every possible misuse scenario or security failure has been eliminated.

Gemini 4 Argon Availability and Pricing

Google plans to expand access to Gemini 4 Argon after gathering feedback and continuing its safeguards work. Paid API customers and Google AI Ultra subscribers are expected to be among the first groups to receive broader access. The announced introductory API pricing is $2 per million input tokens and $10 per million output tokens. Cached input tokens receive a 95% discount on the standard input price. For cybersecurity teams, the key issue is whether the model's reported vulnerability discovery capabilities translate into reliable results across production systems. Its wider rollout will also test whether safeguards can keep pace with AI systems capable of supporting both vulnerability remediation and offensive security techniques.

SonicWall disclosed this week that attackers are chaining two previously unknown vulnerabilities in its SMA1000 secure access appliances to run commands on unpatched devices, and urged customers to install an emergency hotfix.

The more severe flaw, CVE-2026-83548, is a pre-authentication server-side request forgery weakness in the appliance's Appliance Work Place interface, rated 10.0 on the CVSS scale. It lets a remote attacker with no credentials reach sensitive internal functionality. The second, CVE-2026-83549, is an operating-system command injection bug in the Appliance Management Console rated 7.8; on its own it requires administrative authentication, but paired with the SSRF flaw it yields remote code execution.

The vendor said it found both issues internally and then observed them being used together in live attacks. SonicWall has not published indicators of compromise or described the attackers.

Affected products are the SMA1000 series 6210, 7210 and 8200v, in both hardware and virtual form. Fixed builds are 12.4.3-03526 and later, and 12.5.0-02952 and later. SonicWall firewalls running SSL-VPN and the separate SMA 100 line are not affected.

Remediation guidance goes beyond patching. SonicWall told customers to contact its support organization to review appliances for signs of intrusion and, where compromise is suspected, to re-image or redeploy the device, rotate all credentials and reset TOTP tokens — an acknowledgment that one-time-password seeds stored on a breached appliance survive a software update. The company said customers should move to the hotfix release as quickly as possible.

Shadowserver Foundation scanning has tracked more than 400 internet-exposed SMA1000 appliances, though an unknown share of those are already patched. The small install base belies the risk profile. These are remote-access gateways that sit at the network edge and hold credentials for the environments behind them.

The disclosure extends a difficult run for the product line. Attackers exploited a separate pair of SMA1000 zero-days in July 2026, tracked as CVE-2026-15409 and CVE-2026-15410, to deploy custom malware; CISA later confirmed ransomware operators were abusing that access.

Read: CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Another zero-day surfaced in December 2025. Seventeen SonicWall vulnerabilities across the company's product families currently sit in CISA's Known Exploited Vulnerabilities catalog. Edge appliances from SonicWall, Ivanti, Citrix and Fortinet have collectively become the preferred initial-access route for ransomware affiliates and espionage crews, because they are internet-facing by design and rarely instrumented with endpoint detection.