University of Copenhagen data breach exposes 525,000 records in test environment
In short
University of Copenhagen confirmed a cyberattack on a test environment that exposed personal data of about 525,000 people, including CPR numbers and contact details.
The University of Copenhagen data breach occurred when unauthorized access reached a test environment, exposing personal information of roughly 525,000 individuals. The university detected the intrusion on 20 October 2026 and disclosed it publicly three days later. No evidence emerged that attackers reached production systems used for daily operations.
University of Copenhagen data breach timeline and exposed data
Attackers obtained full names, Danish CPR numbers, telephone numbers, and email addresses from the test system. University staff also discovered that PIN codes for about 20,000 ID cards had been compromised in the same incident. The university issued replacement PINs and notified every affected person through Digital Post and public notices.
Physical access to selected campus buildings was restricted on 23 October as a precaution and later restored after the PIN changes. The institution reported the incident to the Danish Data Protection Agency and stated that GDPR obligations apply. Notifications advised recipients to watch for phishing attempts.
Timeline of key events:
- 20 October 2026: Attack detected in test environment.
- 23 October 2026: Public disclosure and initial access restrictions.
- 26 October 2026: Temporary shutdown of administrative systems after apparent new activity.
- 27 October 2026: Clarification that the shutdown related to the original breach.
| Data type | Approximate volume | Notes |
|---|---|---|
| Full names and CPR numbers | 525,000 individuals | Primary identifiers exposed |
| Contact details | 525,000 individuals | Work/home phones and emails |
| ID card PIN codes | 20,000 staff and students | Replaced immediately |
UCPH security measures and higher education context
The university confirmed that day-to-day teaching and research systems remained unaffected by the initial intrusion. On 26 October administrators shut down tools such as Workzone and Nimbus after observing related activity, later confirming the action was preventive rather than a response to a second attack. Controlled reopening of systems continued through late October.
This incident marked the third reported cyber event at a Danish university in October 2026. Earlier cases involved the Technical University of Denmark and Aarhus University. Danish government ministers subsequently met with university leaders to discuss sector-wide cybersecurity standards.
University of Copenhagen continues to investigate the full scope of access and has strengthened monitoring around test environments. Individuals who received notifications are encouraged to monitor their accounts for unusual activity and to treat unsolicited messages with caution. The Danish Data Protection Agency review remains ongoing.
Frequently asked questions
What data was exposed in the University of Copenhagen data breach?
The breach exposed full names, CPR numbers, telephone numbers, and email addresses for approximately 525,000 individuals, plus PIN codes for 20,000 ID cards.
When did the University of Copenhagen detect the cyberattack?
The university detected the intrusion on 20 October 2026 and announced it publicly on 23 October 2026.
Did the breach affect University of Copenhagen operations?
No production systems supporting daily activities were compromised. Temporary shutdowns on 26 October were later tied to the original incident.
What should affected individuals do after the UCPH breach?
Recipients of notifications should watch for phishing attempts and monitor accounts for suspicious activity. Replacement PIN codes were already issued.
TrustScope
Comments 2