University of Copenhagen Breach Exposes 525,000 People's Data

“The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments,” the university says.

The university's account of the intrusion

The University of Copenhagen detected the incident last Tuesday and disclosed it on Friday, saying hackers accessed one of its test environments that contained personal data for roughly 525,000 people. In an update issued yesterday, the university added that another 20,000 staff and students had their PIN codes exposed. The university says it contained the attack and blocked the attacker’s access, and that it is still investigating to determine the full extent of the incident.

What data was exposed

According to the university, the information that may have been accessed includes full names, national identity numbers (CPR), phone numbers, and email addresses. The university explicitly warns that the exposed information increases the risk of phishing and social engineering attacks and advises students and staff to be cautious of unsolicited communications and to independently verify requests.

PIN codes, physical access, and operational impact

In addition to personal contact and identity data, the university reported exposure of PIN codes for approximately 20,000 staff and students. As a precaution, the University of Copenhagen restricted physical access to certain critical locations on its campus and is gradually reopening them while it distributes new access codes. The university also states there is currently no indication that attackers accessed systems supporting daily operations or disrupted university activities.

Regulatory steps and legal framework

The university reported the incident to the Danish Data Protection Agency and said the breach falls within the scope of Europe’s General Data Protection Regulation (GDPR). It told stakeholders it is taking the appropriate steps with the relevant regulators and promised to provide more updates on the scope of the impact as soon as its internal investigation allows.

What this means for technologists, regulators, and students and staff

• Technologists and security teams: The university’s account highlights a test-environment compromise that exposed both identity data and access credentials. The incident underscores the need to review controls around non-production environments and credential management — particularly how test data and access codes are stored and rotated — and to verify containment even after initial blocking of attacker access.
• Regulators and compliance officers: The university has notified the Danish Data Protection Agency and framed the incident under GDPR. Regulators will be watching remediation steps, notification practices, and whether the university’s follow-up reporting clarifies the scope and harm to affected individuals.
• Students and staff: Roughly 525,000 people may have had names, CPR numbers, phone numbers, and email addresses exposed, and some 20,000 had PINs exposed. The university’s direct advice is to be cautious about unsolicited messages and to independently verify any requests for information or action as it replaces access codes and reopens restricted locations.

The University of Copenhagen, founded in 1479 and home to about 36,800 students and 10,700 employees across six faculties and more than 200 research centers, says it will provide more updates as its internal investigation permits. One external line in the reporting also notes a broader defensive lesson: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 that contains that assessment measures defenses technique by technique across 338 million simulations run in customer production environments — a reminder embedded in this case that exposure of credentials and identity data can shift an incident from disruption to targeted misuse.

The immediate questions left open are operational and practical: the university’s investigation will need to establish exactly which records were copied, whether exposed access codes were used, and how replacement and post-exposure monitoring will be validated. Until those details arrive, the university’s containment, its reporting to Danish authorities, and its guidance to affected people are the concrete steps now on the record.

Original reporting