University of Copenhagen Confirms Data Breach Affecting 525,000 People

The University of Copenhagen has confirmed a data breach affecting about 525,000 individuals after hackers accessed a test environment that contained personal information.

The intrusion was detected on October 20 and publicly disclosed on October 23. Investigators are working to determine the full extent of the exposure.

The compromised database included full names, Danish national identity numbers, work and private telephone numbers, and personal email addresses. University officials said they have blocked the attackers’ access and contained the initial attack.

University of Copenhagen Data Breach

According to Dark Web Informer, the university confirmed that unauthorized access to the information occurred but has not publicly stated whether the attackers extracted the entire dataset.

Additionally, it has not disclosed the initial access method, any exploited vulnerabilities, or the identities of those responsible for the breach.

The combination of identity numbers and contact information heightens the risk of targeted phishing and social engineering attacks. Scammers could use these details to make fraudulent communications appear legitimate. Affected individuals should independently verify unexpected requests, especially those seeking credentials or additional personal information.

In its initial statement, the university said there was no evidence that the attackers had reached systems supporting daily operations or disrupted university activities. This assessment applies specifically to the original intrusion, not subsequent developments.

On October 25, an update revealed that PIN codes for ID cards belonging to approximately 20,000 affected staff members and students were also compromised. The university issued replacement codes before publicly disclosing this information.

Following a security assessment, officials restricted physical access to certain critical campus locations on October 23. The university reopened these locations after distributing replacement PINs.

The university emphasized that exposing these PINs was part of the previously reported incident, not a separate breach. The announcement clarified that the affected staff and students do not represent an additional group beyond the initial 525,000 individuals reported.

Later, the university reported another hacking incident on Monday, October 26. In response, administrators implemented preventive, controlled shutdowns of several administrative systems, including Workzone and Nimbus. They warned of potential difficulties accessing university websites.

The university has not disclosed whether this new attack is connected to the earlier breach. Officials reported the original incident to the Danish Data Protection Agency and informed other relevant authorities. The university considers the breach subject to the General Data Protection Regulation and said it will provide further information as investigators gain a clearer understanding of the situation.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.