The University of Copenhagen has confirmed a cyberattack in which hackers gained access to one of the institution’s test environments, exposing personal data belonging to approximately 525,000 people. The university detected the breach last Tuesday and disclosed it publicly on Friday.
Founded in 1479, the University of Copenhagen is Denmark’s oldest university and one of its leading research institutions, with roughly 36,800 students and 10,700 employees across six faculties and more than 200 research centers.
In an update issued the following day, the university disclosed that an additional 20,000 staff and students had PIN codes exposed in the incident. The following categories of data may have been compromised:
- Full names
- National identity numbers (CPR)
- Phone numbers
- Email addresses
The university says the exposed data raises the risk of phishing and social engineering attacks targeting affected individuals. It is urging students and staff to be cautious of unsolicited communications and to independently verify any requests for information.
Because the PIN exposure could affect physical access controls, the university restricted entry to certain critical locations on campus as a precaution. It is gradually reopening those areas as new access codes are distributed.
The university states that it has contained the attack and blocked the attacker’s access. At this stage, there is no indication that hackers reached systems supporting daily operations, and university activities have not been disrupted.
The incident has been reported to the Danish Data Protection Agency, and the university acknowledges the breach falls under the scope of the EU’s General Data Protection Regulation (GDPR). It says it is coordinating with relevant regulators as required.
An internal investigation is ongoing to determine the full extent of the breach, and the university has pledged to provide further updates on the scope of impact as the investigation progresses.
