Denmark is investigating a data breach affecting approximately 8.8 million people after unauthorized users gained access to its national population register, the government said Monday.

The perpetrators exploited an unnamed domestic company’s legitimate access to Denmark’s Central Person Register (CPR) to compromise names, addresses and CPR numbers — roughly comparable to Social Security numbers in the U.S.

In total, the register holds information on around 11 million people, including current residents, people who have moved abroad and those who are deceased. Denmark’s current population is just over six million.

“This is a deeply serious incident,” Christina Egelund, the minister for research, education and digitalisation, said in a statement. She added that she had ordered a broad security review of the system, and that the country’s hotline for digital security will be operating at extended hours, from 8 a.m. to midnight, in the coming days.

Officials said they first detected irregular activity affecting the CPR system on Friday. Investigations over the weekend determined that the breach occurred during September, they said, although they did not comment on who the perpetrators may be.

Denmark’s Data Protection Agency said it was notified of the breach Sunday and described it as involving a very large number of automated searches on the system aimed at identifying valid CPR numbers.