3 Danmark Data Breach: What Customers Need to Know

In short: 3 Danmark said on 23 October 2026 that an unauthorised person may have accessed the first names, surnames and addresses of private customers, according to 3's own incident page. Its investigation covers about 400,000 private customers, though 3 says it has not yet established that all of them are affected, according to the company's press release. The company says CPR numbers, passwords and payment details were not exposed, and that it will contact affected customers directly rather than requiring them to call in.

If you are a 3 Danmark customer, the breach itself is unlikely to drain your bank account on its own. The risk is what happens next: someone using your real name and address to make a scam message, call or letter look legitimate. Here is what the company has confirmed, what it hasn't, and what to do while you wait to hear whether you're affected.

What data was exposed in the 3 Danmark breach?

3 says the incident involves only first name, surname and address of private customers — nothing more. On its incident page, the company states plainly that "Det er alene er fornavn, efternavn og adresse, der kan være berørt," meaning only first name, surname and address can be affected. The company says it has blocked the access it identified and is still working to establish the full scope of the incident. The investigation covers "omkring 400.000 privatkunder" (about 400,000 private customers), but 3 says it has not yet been established that all of them are affected. The incident page was last updated on 23 October 2026 at 22:45, the evening the breach was disclosed.

What wasn't exposed — should I worry about identity theft?

3 says on its incident page that CPR numbers and payment information are not part of this incident, and that based on what it knows now, customers do not need to change their password, set up a credit warning, or call their bank. That's a meaningfully smaller exposure than a breach involving financial data or national ID numbers. It doesn't mean nothing is at risk, though: a name and a home address are exactly the ingredients scammers use to make a fake message feel real.

How do I spot phishing that uses my name and address?

3 itself warns that "fornavn, efternavn og adresse kan bruges til at gøre falske henvendelser mere troværdige" — name and address data can be used to make fraudulent approaches look more credible — and tells customers to be alert to unexpected calls, texts and emails. The UK's National Cyber Security Centre makes the same point more broadly: criminals use information available about a target "to make their phishing messages more convincing," which is exactly why a breach like this one raises phishing risk even without passwords or financial data, as the NCSC's phishing guidance explains. Expect a possible uptick in messages pretending to be from 3, a delivery firm, or a debt collector, using your correct name and address to sound genuine.

Is my MitID safe after this breach?

Nothing in this incident touches your MitID: 3 says only name and address may be affected, and no login credentials. The risk is that a scammer armed with your name and address talks you into approving a MitID request yourself. 3's incident page explicitly tells customers never to hand over login, payment or MitID details to anyone who contacts them, regardless of how convincing the call or message sounds. Never approve a MitID request triggered by an unsolicited call, text or email, even if the caller already knows your name and address.

What are my GDPR rights, and how do I ask 3 for my data?

Under the EU's GDPR, companies must notify individuals "without undue delay" when a breach is likely to pose a high risk to their rights, as set out in Article 34 of the regulation. You also have a standing right to ask any company what personal data it holds on you and why — our guide to making a GDPR data request walks through how. In Denmark, complaints and questions about how a company has handled personal data go to Datatilsynet, the Danish Data Protection Agency, which describes itself as "the independent authority that supervises compliance with the rules on protection of personal data" and publishes guidance on how to file a complaint.

How do I find out if I'm one of the affected customers?

3 says affected customers don't need to contact customer service to find out if they're included — the company says on its incident page that it will reach out directly to those it identifies as affected once its investigation establishes the exact scope.

Checklist: what to do right now

1. Don't call or message 3 to ask if you're affected — the company says it will contact you directly if its investigation shows you are, per its incident page.
2. Treat unexpected calls, texts, letters or emails claiming to be from 3, a delivery company or a debt collector with suspicion, especially if they use your correct name and address to seem legitimate.
3. Never give out login details, payment information or MitID approvals to anyone who contacts you first, no matter how official they sound.
4. If you need to check something with 3, log in only through 3's own app or through the company's official site directly — not a link sent to you.
5. Follow 3's own guidance: based on what's known so far, there's no stated need to change your password, set up a credit warning, or call your bank over this specific incident.
6. Use your GDPR right of access to ask 3 exactly what data it held on you and whether you were affected; see our guide to requesting your data under GDPR.
7. If you believe 3 has mishandled your data, you can raise it with Datatilsynet, Denmark's data protection authority, via its English-language complaints guidance.
8. For a broader run-through of breach response steps, see our full data breach response checklist.

What remains unclear is the exact number of people affected — 3 has not published a figure, nor a timeline for when its investigation will finish identifying who was affected. If weeks pass and you've heard nothing from 3, that doesn't confirm you're unaffected: the company's own incident page says only that it will contact those it identifies once the investigation establishes the scope, with no promised deadline for finishing that work. In that gap, keep treating unexpected calls or messages using your name and address with suspicion rather than waiting for an official notice to start being careful.

If you're dealing with more than one breach notice this year, read our full data breach response checklist for the next steps to take across all of them.

Updated 27 October 2026: Added a paragraph on what to do if you haven't heard from 3 after weeks of waiting, plus a closing link to the full data breach response checklist.