Executive Summary
The University of Copenhagen data breach exposed personal data on about 525,000 people after attackers reached one of the university’s test environments, the university disclosed on 23 October 2026. The database held full names, Danish CPR (national identity) numbers, work and home phone numbers and personal email addresses. The attack was detected on Tuesday 20 October and brought under control. It has been reported to the Danish Data Protection Agency (Datatilsynet). On 25 October the university added that ID-card PIN codes for about 20,000 staff and students were compromised. A day later it shut down several administrative systems after what it called a new hacker attack. The university hasn’t said how the attackers got in.
What the University of Copenhagen Breach Exposed
The figure comes from a single database. In its incident statement posted at 20:05 on 23 October, the university said the hackers had gained access to information on approximately 525,000 individuals. It was still analysing the precise extent of the breach and found no sign that systems supporting day-to-day operations were reached.
The university hasn’t said which system the test environment belonged to or why it held live personal data.
Nor has it said who the 525,000 people are.
Three days passed between detection and the public statement. The university said the incident falls under the GDPR and that other relevant authorities are being kept closely informed. It did not give the date it notified Datatilsynet.
20,000 Access-Card PINs Held Back Until Changed
In an update at 20:00 on 25 October the university said PIN codes for the ID cards of about 20,000 staff and students had been compromised in the same attack. It called this neither a new leak nor a new attack. For security reasons it had chosen not to mention the cards until the codes were changed. On the evening of 23 October it restricted physical access to selected critical locations on campus. Those locations reopened once the new PINs were issued.
Systems Shut on 26 October
At 17:50 on 26 October the Danish version of the incident page reported a preventive and controlled shutdown of several administrative systems including Workzone and Nimbus. The reason given: the university had been exposed to a new hacker attack earlier that day. Its websites could be hard to reach. It has made no further comment.
Aarhus and DTU Incidents Earlier in October
The Ministry of Social Security and Preparedness and the Danish Agency for Social Security (Styrelsen for Samfundssikkerhed) said on 23 October they were following the incidents at the University of Copenhagen and Aarhus University together with the research and education ministry. Earlier in October the Technical University of Denmark (DTU) disclosed that attackers using compromised DTU profiles had entered DTUBasen, its identity and access management system, which holds personal data back to 2003. Aarhus University has put the number of DTU users who may be affected at up to 200,000.
This is also not the University of Copenhagen’s first breach notification this year. In May 2026 its Absalon course platform, built on Instructure’s Canvas, was caught up in the attack on that supplier. The university’s Absalon notice said the supplier had confirmed course information for up to 160,000 current and former students was involved and in a worst case 70,000 current and former teaching staff and administrators. The university notified Datatilsynet on 5 May 2026.
Questions the University Has Left Open
Several gaps in the University of Copenhagen data breach remain as of 27 October. The university hasn’t said how the attackers reached the test environment, whether the 26 October attack is linked to the first one or whether the 525,000 people will be notified individually. No attacker has been named. The university has said it will give more information once it has a clearer picture.
CPR Numbers Were Off the Table in May
In May the university told students and staff that the Canvas attackers had not had access to CPR numbers, passwords or name-and-address protected information. Five months later CPR numbers are among the fields in the exposed database. That database sat in a test environment rather than a production system. DTU’s own notice warns that CPR numbers in the wrong hands can be used for identity fraud and more convincing phishing. As of 27 October the University of Copenhagen had not said whether its 26 October shutdown involved the same environment.
References
- Operational disruptions at UCPH
- Driftsforstyrrelser på KU
- Security breach in Absalon
- Cyberhændelserne ved Københavns Universitet og Aarhus Universitet
- Cyberattack on DTU: Notification of a personal data breach
- Why Danish universities are attractive targets for hackers
This post is also available in:
Svenska
