3 Data Breach: What Was Exposed and What to Do

In short: Telecom provider 3 Danmark says an unauthorized party may have accessed the first name, surname and address of around 400,000 private customers through unauthorized access via an API, 3's incident page says. CPR numbers, passwords and payment details were not part of this incident, and 3 says it will contact affected customers directly rather than requiring them to call in.

The 3 data breach was disclosed on 23 October 2026, with the company telling customers on 26 October by email that their name and address had been exposed, Computerworld reports. The company says the unauthorized access happened through an API — a technical connection that lets digital systems exchange information — in its Danish business.

What was exposed in the 3 data breach?

Only first name, surname and address, according to 3's own FAQ: "Det er alene er fornavn, efternavn og adresse, der kan være berørt," the company states on its incident page. The access occurred via an API in 3's Danish systems, and 3 says that access has since been blocked while it works to establish the full scope, according to the company's press release.

What was NOT exposed, and why does it matter?

CPR numbers (Denmark's personal ID numbers), passwords and payment details were not part of this incident, per 3's own statement. That distinction matters because it separates this from a financial identity-theft case: nobody can open a loan or drain a bank account using just a name and address. The risk here is social engineering, not direct fraud, which is why 3 says that "på baggrund af det, vi ved nu," there is currently no need to change passwords, set up a credit warning, or contact your bank, the company writes. It adds it will reach out directly to affected customers if that assessment changes.

How many customers are affected, exactly?

3's investigation covers roughly 400,000 private customers, but the company is careful to say not all of them are confirmed as affected: "Undersøgelsen omfatter omkring 400.000 privatkunder, men det er endnu ikke fastslået, at alle er berørt," 3 said in its press release. 3's CTIO Rajib Eklund said the company "tager sagen alvorligt" and is working to pin down the exact scope so affected customers get accurate information.

What's still unknown?

Three things aren't public yet: who carried out the unauthorized access, the final confirmed number of customers actually affected (as opposed to the roughly 400,000 under investigation), and the exact technical path the attacker used beyond access via an API. 3 says relevant authorities have been informed, and that the incident is unrelated to PHP vulnerabilities reported earlier, but it has not named an attacker or published a final tally, according to its press release. Treat any claim about who did it as speculation until 3 or an official body confirms it.

Why should I be on alert for phishing?

Because a name and address make fake messages more convincing. 3 itself warns: "Fornavn, efternavn og adresse kan bruges til at gøre falske henvendelser mere troværdige," and tells customers to be especially alert to unexpected calls, texts and emails, and to never share login, payment or MitID details, per 3's guidance. For a broader rundown of red flags, see how to spot phishing after a data breach.

What should I do if I'm a 3 customer?

3 says it will contact affected customers directly, so you don't need to call to find out if you're on the list, the company notes. Still, a few precautions are worth taking:

1. Watch for an unusual call, text or email claiming to be from 3 asking you to confirm details, click a link, or share MitID credentials — then hang up or delete it.
2. Never give out login, payment or MitID information in response to an unsolicited message, even if it mentions your correct name and address.
3. If you spot a suspicious message, verify through 3's official channels rather than replying directly or clicking any link in it.
4. Change passwords only for accounts where actual login data was exposed; 3 says this specific incident does not require a password change at this time.
5. Keep an eye on mail and email for unexpected bills, deliveries or account notices, which can be a sign your address is being used for impersonation.
6. If CPR numbers were ever exposed in a breach — which 3 says is not the case here — you can register a credit warning (kreditadvarsel) yourself through the self-service tool on borger.dk, Denmark's citizen portal; it's registered in CPR immediately, though it can take a few days to take effect with companies.
7. For a general sequence to follow after any breach, see what to do after a data breach checklist.

What does 3 say about the actual risk?

3 says that, based on what it currently knows, the incident "efter al sandsynlighed ikke indebærer nogen risiko for kunderne" — most likely poses no risk to customers — while still urging caution around any request to share data or click links, Computerworld reported from 3's statement. 3 is the latest Danish company hit by a cyberattack recently, following incidents at Magasin du Nord, the CPR register and the University of Copenhagen, per the same report. For background on 3's earlier security notices, see 3 Danmark's earlier coverage.