Copenhagen University Attack Affected Test Environment With Data of 525,000 People
The University of Copenhagen is addressing unauthorized access to a test environment containing personal data of approximately 525,000 people. The incident also involved access-card PINs for about 20,000 people.
An attack on the University of Copenhagen affected one of the school’s test environments, which contained personal data of approximately 525,000 people. The University of Copenhagen detected the incident on October 20 and announced on October 23 that it had blocked the attackers’ access and brought the situation under control.
The affected database contained names, Danish personal identification numbers (CPR), work and private telephone numbers, and private email addresses. The university also said it had no indication that the attackers had penetrated systems used for regular operations or that the incident had disrupted its activities.
The Copenhagen University attack and the scope of the exposed data
Unauthorized access to the test environment has been confirmed, but not the theft or publication of the data. The university continues to analyze the exact scope of the incident. It has not yet confirmed whether the attackers exfiltrated the data or the final number of people affected.
The attackers’ identity and motivation, the method of entry, and the reason the data was stored in the test environment are also unknown. Misuse of the personal data has not been confirmed either.
The combination of CPR numbers and contact details poses a risk of targeted phishing or social engineering scams. Affected individuals should therefore exercise caution with unsolicited emails, phone calls, and messages that may purport to come from the university or another trusted organization.
University replaced access-card PINs
In a subsequent notice, the university also confirmed that access-card PINs for approximately 20,000 employees and students had been compromised. This aspect of the incident concerned physical access to school premises.
The university issued new codes to the affected people. Access to selected areas was temporarily restricted, after which the school reopened them. It has not been confirmed that the compromised PINs were used for unauthorized entry.
Regulatory report and continued system restrictions
The university reported the case to Denmark’s data protection authority, Datatilsynet, and is assessing it under the GDPR. Further clarification may come from the investigation, including findings about the possible transfer of data outside the university’s systems.
According to secondary reporting, on October 27 the university corrected its initial assessment of suspicious activity from Monday. It was not a separate second cyberattack, but circumstances related to the original incident. Some administrative systems remain shut down as a precaution.
Further information should clarify the number of people affected, any data exfiltration, the restoration of administrative systems, and the actions of Denmark’s Datatilsynet authority.
Sources
- University of Copenhagen – Primarily confirms the attackers’ access to the test environment, approximately 525,000 people affected, the types of data, the report to Datatilsynet, and the absence of indications that operational systems were affected.
- Help Net Security – Corroborates the update about PINs belonging to approximately 20,000 people and reports that the university later ruled out a separate second cyberattack.
- BleepingComputer – Independently summarizes the university’s announcement, the affected data categories, the replacement of access codes, and the ongoing investigation.
Verified and updated: October 27, 2026, 15:25
