Image: Wikimedia Commons — the University of Copenhagen's main building at Frue Plads.
TL;DR — University of Copenhagen data breach 525000 explained: Hackers got into a University of Copenhagen test environment holding personal data on about 525,000 people — including Danish CPR national ID numbers — and days later the university was hit a second time, shutting down administrative systems. The university says the first breach did not reach systems running daily operations, but exposed national ID numbers raise the phishing and fraud risk for years, not days.
📌 KEY HIGHLIGHTS
- First breach detected Tuesday 20 October 2026 and disclosed Friday 23 October: a test environment holding personal data on about 525,000 people.
- Data exposed: full names, Danish CPR national identity numbers, work and home phone numbers, and personal email addresses.
- Sunday 25 October update: ID card PINs of about 20,000 students and employees were also compromised in the first attack; new PINs have been issued.
- Second attack on Monday 26 October: a precautionary, controlled shutdown of administrative systems including Workzone and Nimbus, with some university websites disrupted.
- The university has not established a connection between the two attacks, has not published a breakdown of who the 525,000 are, and has reported the breach to Denmark's Data Protection Agency under GDPR.
What happened?
Denmark's oldest university — founded in 1479, with about 36,800 students and 10,700 employees — found itself dealing with two separate cyber incidents in a single week. The first began quietly: on Tuesday 20 October, the University of Copenhagen detected an intrusion into one of its test environments. Test environments are supposed to be the safe place where software is tried out before it goes live. This one, however, held real personal data — and the attackers got to it.
On Friday 23 October the university went public. In its statement it confirmed a cyber attack in which hackers gained access to that test environment, and warned that information on approximately 525,000 individuals may have been exposed. Access has since been blocked, and the university says it is working intensively to establish the full extent of the incident. So far, it says, there is no indication the attackers reached systems supporting day-to-day operations, and teaching and other activities were not disrupted by this first incident.
The story grew on Sunday 25 October, when a further update revealed that ID card PINs belonging to about 20,000 students and employees had also been compromised in the same attack. Those people have been given new PINs. As a precaution, physical access to certain critical campus locations was restricted on Friday and then gradually reopened as the new codes went out. The university said it delayed disclosing the PIN detail until the codes had been changed, for security reasons — and stressed that the Sunday disclosure concerned the first attack, not a new intrusion.
University of Copenhagen data breach 525000 explained: what was exposed
| Data exposed | Why it matters |
|---|---|
| Full names | Identifies the victim for targeted phishing |
| CPR numbers (Danish national ID) | Denmark's equivalent of a Social Security number — used across public services and banking, and effectively impossible to change |
| Work and home phone numbers | Enables phone and SMS phishing (vishing and smishing) |
| Personal email addresses | Enables convincing phishing emails impersonating the university or authorities |
| ID card PINs (about 20,000 people) | Could have opened restricted campus locations before the codes were replaced |
Illustrative image: digital security (Wikimedia Commons).
The second attack: systems shut down on Monday
Then, on Monday 26 October, the university was attacked again. In an update issued at 17:50 that day, it said it had been attacked earlier on Monday and had closed several administrative systems as a precautionary and controlled shutdown. Administrative services including Workzone and Nimbus were disrupted, and the university warned that access to some of its websites could also be disrupted. The shutdown marks a change from the first incident: this time, systems were taken offline deliberately, rather than left running.
What the university has not said about the second attack matters as much as what it has. It has not disclosed how the attackers entered its systems, whether any information was accessed during Monday's incident, or when the affected services might be restored — and said it had no further comments at that stage. The attack was also reported by Danish broadcaster TV 2 Kosmopol. Crucially, the university has not established a connection between the two attacks: treat them as two separate incidents until evidence says otherwise.
Why it matters beyond Copenhagen
The Copenhagen incidents are not isolated. They follow cyberattacks at Aarhus University — where a hacking attempt targeting the passwords of about 1,700 students and employees was discovered and stopped — and at the Technical University of Denmark, with no connection established between these separate cases. Danish reporting also notes a wider pattern this month: almost 9 million CPR numbers were leaked in a hack of the Danish CPR registry earlier in October, and the Magasin department store's customer rewards programme was hacked, discovered on 18 October and disclosed on 21 October.
The deeper lesson is about test environments. A test system holding real personal data on half a million people, guarded less strictly than production systems, is exactly the soft spot attackers look for: copies of production data, weaker access control, and less monitoring. The university's own experience proves the point — the first breach caused no operational disruption precisely because it hit a test environment, yet the data loss is just as real as if it had hit a live system.
For readers anywhere, the practical risk is phishing. The university itself warns that the exposed information increases the risk of phishing and social engineering attacks, and advises students and staff to be cautious of unsolicited communications and to verify requests independently. A CPR number cannot be reissued like a password, so this data will stay useful to criminals for years. If you have ever studied at, worked for, or collaborated with the University of Copenhagen, assume you could be among the 525,000 until the university publishes a breakdown — it has not said which groups are included.
There is a direct parallel in this week's other big security story: the PHP2Shell flaws added to CISA's exploited list, where confirmed exploitation turned a patch into an emergency. And the LiteLLM supply-chain compromise showed the same pattern from the other side — trusted channels, quietly abused. The common thread is that the damage is often done before anyone announces it.
Should you care? ✅ Yes — if you have any link to the university; 👀 watch if you don't
Verdict: If you are a current or former Copenhagen student, employee, researcher or collaborator, take the phishing warnings seriously: expect convincing scam messages using your real name and phone number, and never act on an unexpected request without verifying it through a separate channel. If you have no link to the university, this is still the clearest case study of the year in why test environments must never hold real personal data — and why a national ID number leak is a decade-long problem, not a news-cycle one.
FAQs
What data was exposed in the University of Copenhagen breach? Full names, Danish CPR national identity numbers, work and home telephone numbers, and personal email addresses belonging to about 525,000 people, plus ID card PINs of about 20,000 students and employees. The university is still investigating the full extent and has not published a breakdown of which groups of people are included.
What is a CPR number and why does its exposure matter? The CPR number is Denmark's national identity number, used across healthcare, banking and public services — the Danish equivalent of a US Social Security number. Unlike a password, it cannot easily be changed, so a leak keeps enabling identity fraud and convincing phishing for years.
Was there a second cyberattack at the University of Copenhagen? Yes. On Monday 26 October the university said it had been attacked again earlier that day and shut down several administrative systems, including Workzone and Nimbus, as a precautionary and controlled shutdown. It has not said how attackers got in, whether data was accessed, or when services will be restored, and it has not established a connection between the two attacks.
What should I do if my data was in the breach? Be suspicious of unsolicited calls, texts and emails — especially any that use your real name or claim to be from the university, a bank or an authority — and verify requests through a separate, trusted channel before acting. If you are a student or employee, use the new ID card PIN the university issued, and watch for official updates as the investigation continues.
Takeaway: Two attacks in one week, half a million people's national ID numbers in a test environment, and a second shutdown nobody can yet explain — Copenhagen's week is a warning that the least-guarded copy of your data is often the one that gets stolen.
Follow UK & Europe Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
BleepingComputer — University of Copenhagen data breach exposes data of 525,000 people (26 Oct 2026) • Nordisk Post — Another cyberattack at the University of Copenhagen disrupts systems (27 Oct 2026) • Nordisk Post — University of Copenhagen cyberattack exposes data on 525,000 people (24 Oct 2026) • Danish Dispatch — Copenhagen University hacked: 525,000 people's data stolen. University statements via ku.dk as reported by the above. Checked 27 Oct 2026.
Comments
Post a Comment