"The database contains personally identifiable information such as full name, national identity number, work telephone number, home telephone number and personal email address," the University of Copenhagen (UCPH) warned after a cyber-attack that the institution says affected roughly 525,000 people.
Timeline: detection, disclosure, and updates
UCPH detected the intrusion on October 20, and the university says the incident was "subsequently brought under control." The initial public notice was issued on October 23, and on October 25 the university published an update expanding the list of exposed material to include "physical access PIN codes for around 20,0000 staff and students." The university also confirmed that three administrative systems — the document management platform Workzone and application budgeting tool Nimbus among them — experienced disruption during the incident.
Scale and sensitivity of the exposed data
The university estimates about 525,000 people were affected. According to UCPH’s notice, the compromised test environment stored personally identifiable information (PII) including full name, national identity number, work telephone number, home telephone number and personal email address. The combination of national identity numbers and contact details raises a heightened risk of identity fraud and the creation of convincing follow-on phishing or social-engineering attacks, the university’s summary implies.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOperational consequences and immediate mitigations
UCPH initially stated there was "no indication" that attackers accessed systems "supporting day-to-day operations" or that its "activities or operations" had been impacted. The university later acknowledged administrative disruption and said it performed "a preventive and controlled shutdown of the administrative systems in question" after what it described as exposure to a "new hacker attack" earlier in the week. On October 23 the university restricted physical access to "selected critical locations on campus" while resetting the compromised PIN codes.
Context within higher education cyber activity
UCPH’s breach comes amid a broader pattern of intrusions targeting universities. According to a Comparitech study from July, ransomware attacks against universities rose by 8% in the first half of the year, driven mainly by a group the study named The Gentlemen. The UK government reported on April 30 that almost every higher education institution (98%) identified a breach or attack in the previous 12 months. Separately, this year the ShinyHunters group targeted the Canvas Learning Management System, compromising around 275 million records from over 8,000 educational institutions — a sector-wide incident referenced by the university’s notice to place this breach in context.
What this means for students, staff, and administrators
- Students: Those whose PII is listed should expect increased phishing attempts and possible identity-fraud risks because national identity numbers and contact details were exposed.
- Staff: Employees impacted by the PIN-code disclosure face immediate physical-access changes as UCPH resets codes; they may also need to monitor work-related accounts and telephony for suspicious activity.
- Campus administrators: The university has already taken administrative systems offline as a preventive measure and has reported the incident to the Danish Data Protection Agency. Administrators will be watching for follow-on intrusions, service-restoration challenges, and regulator guidance under GDPR.
No threat actor had publicly claimed responsibility at the time of writing. UCPH has told affected parties it estimates the incident falls within the scope of the General Data Protection Regulation (GDPR), and that the matter is being handled "in accordance with applicable regulations." The university has reported the breach to the Danish Data Protection Agency and says other relevant authorities are being kept closely informed.
The incident highlights a familiar paradox for large public research institutions: open, decentralized systems and large user populations increase utility and vulnerability alike. For now, the concrete threads to follow are whether the university completes its PIN-code reset without incident, how many administrative services remain disrupted after the controlled shutdowns, and whether any actor steps forward to claim responsibility or seeks to monetize the exposed PII. Until then, the university’s disclosures and regulator notifications are the clearest record available of an event that, by the numbers and the types of data involved, ranks among the more significant academic-sector breaches reported this year.
https://www.infosecurity-magazine.com/news/copenhagen-university-data-breach/
