The Danish government has confirmed that its central database of citizens’ data was breached and most of its contents were stolen. The data breach affects some 8 million citizens and residents of Denmark, including people living abroad and the deceased.

In a statement, Danish minister Christina Egelund said the breach of the country’s Central Person Register (CPR) was a “serious incident,” which allowed hackers to steal names, addresses, Danish social security numbers, and other information.

The CPR is a government database of Danish citizens’ information, including their government-issued identity number for paying taxes and accessing other services. Denmark’s current population is about 6 million people, but the database includes records for about 11 million people, with some of the data going back decades. 

The Danish government would not say who is behind the breach, which happened in September but was discovered on October 2. However, it said the unauthorized access was obtained by “abusing a Danish company’s lawful access to search for information in the CPR system.” (Some companies in Denmark have access to the CPR for verifying people’s information with the government.)

The data breach is thought to be the biggest in the country’s history. It follows similar cyberattacks targeting government national identity databases, including a 2016 breach affecting millions of Turkish citizens and several exposures of national ID cards and data spilled from India’s national Aadhaar database of citizens.