The University of Copenhagen confirmed hackers accessed a test environment containing personal data for 525,000 people, including national identity numbers, with an additional 20,000 staff and student PIN codes also exposed.
The University of Copenhagen confirmed on Friday that hackers gained unauthorized access to one of its test environments, exposing personal data belonging to 525,000 people — a figure that has grown since the institution first detected the intrusion last Tuesday.
In a subsequent update, the university disclosed that an additional 20,000 staff and students had their PIN codes exposed in the same incident, prompting administrators to restrict physical access to certain critical campus locations as a precautionary measure.
"The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university's test environments," the university said in a statement. The institution added that it is gradually reopening restricted areas as new access codes are distributed.
The categories of data potentially compromised include full names, national identity numbers — known in Denmark as CPR numbers — phone numbers, and email addresses. The university cautioned that the exposed information elevates the risk of phishing and social engineering campaigns targeting affected individuals.
Founded in 1479, the University of Copenhagen is Denmark's oldest university and one of its primary research institutions, with approximately 36,800 students and 10,700 employees across six faculties and more than 200 research centers.
University officials said the attacker's access has since been contained and blocked. There is currently no indication that systems supporting daily operations were accessed or that university activities were disrupted.
The institution reported the incident to the Danish Data Protection Agency and acknowledged that the breach falls within the scope of Europe's General Data Protection Regulation, adding that it is taking appropriate steps with relevant regulators.
Students and staff whose data may have been affected are advised to exercise caution with unsolicited communications and to independently verify any requests they receive. The university said it will continue issuing updates as its internal investigation progresses.
The Copenhagen breach comes amid a broader pattern of threat actors targeting educational institutions, which have frequently appeared on lists of sectors most affected by ransomware and data theft operations. The incident also reflects the growing exposure risk posed by data held in non-production environments, which organizations sometimes subject to less rigorous security controls than live systems.
The university has not disclosed the identity of the attacker or the method used to gain entry, and the investigation into the full scope of the breach remains ongoing.
Jay Goldberg is a staff writer at TechEchelon covering technology, markets, and policy. He files the breaking news and deal coverage that move the publication's core desks.
More from Jay →Fifty-nine percent of U.S. employees say they are not fully prepared to spot modern payment scams, and only 23 percent say their company uses dedicated fraud-monitoring tools, according to research commissioned by payment-verification firm Eftsure.
A UEFI bootkit named BlackX, attributed with medium confidence to Chinese state-sponsored group APT41, exploited the Baton Drop vulnerability to bypass Secure Boot on fully patched Windows systems in a 2026 espionage campaign targeting Central Asian diplomatic agencies.
Quest Diagnostics confirmed a data breach affecting patient records after a threat actor gained unauthorized access to its Quanum LSM laboratory management platform, the company disclosed in an SEC filing on October 23.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.