Copenhagen University breach exposes data of 525,000 people

The University of Copenhagen (UCPH) says a cyber-attack compromised sensitive personally identifiable information (PII) affecting about 525,000 people. The breach occurred when hackers allegedly accessed a test environment, with the university noting that the attack was detected on 20 October and brought under control soon after, but it took three more days to issue a public notification.

A later update on 25 October claimed that physical access PIN codes for around 20,000 staff and students were also compromised, expanding the scope of affected individuals. The university states the database contained data such as full names, national identity numbers, work and home telephone numbers, and personal email addresses, and that the incident falls within the GDPR framework with authorities being informed.

Initial university statements suggested there was no indication that systems supporting day-to-day operations were accessed or that operations were disrupted. However, UCPH subsequently confirmed disruption to several administrative systems, including the document management platform Workzone and the budgeting tool Nimbus, describing the actions as a preventive and controlled shutdown of the affected systems.

On 23 October the university restricted physical access to selected critical locations on campus while compromised PIN codes were reset. The incident has been reported to the Danish Data Protection Agency, with the university noting ongoing coordination with relevant authorities, and no group had publicly claimed responsibility at the time of reporting.

The breach is framed as one of the largest in the sector this year in terms of victim count and data sensitivity, with potential implications for follow-on phishing and identity fraud.