Copenhagen University Breach Exposes Data of Over Half a Million Individuals
The University of Copenhagen has disclosed a significant data breach affecting over 520,000 individuals, with personal information including national identity numbers and PIN codes compromised.
The University of Copenhagen (UCPH) has become the latest victim of a large-scale data breach, impacting an estimated 525,000 individuals. The incident, detected on October 20, 2026, involved unauthorized access to a test environment, from which hackers exfiltrated sensitive personal data. The university took three days to publicly disclose the breach, issuing an initial notification on October 23 and providing an update on October 25.
Initially, the university stated that the compromised database contained personally identifiable information (PII) such as full names, national identity numbers, work and home telephone numbers, and personal email addresses. Crucially, a subsequent update revealed that physical access PIN codes for approximately 200,000 staff and students were also compromised. The university has acknowledged that the incident likely falls under the scope of the General Data Protection Regulation (GDPR) and has reported the matter to the Danish Data Protection Agency and other relevant authorities.
While UCPH initially claimed that the breach did not affect systems supporting day-to-day operations, it later admitted to disruptions in several administrative systems. These included the document management platform Workzone and the application budgeting tool Nimbus. The university implemented a "preventive and controlled shutdown" of these systems following a new hacker attack on the Monday after the initial disclosure, which also led to challenges accessing UCPH's websites. Physical access to selected critical campus locations was also restricted as PIN codes were reset.
Higher education institutions remain attractive targets for cybercriminals and nation-state actors due to their extensive networks, large user bases, and valuable data, which can include sensitive research and intellectual property alongside student and staff PII. A recent study indicated a rise in ransomware attacks against universities, with attackers like The Gentlemen group being significant contributors. The decentralized nature of university networks and a low tolerance for outages further exacerbate their vulnerability.
Statistics from the UK government revealed that nearly all higher education institutions (98%) identified a breach or attack in the preceding 12 months. One of the largest incidents in the sector this year involved the Canvas Learning Management System, where attackers compromised around 275 million records from over 8,000 educational institutions. The Copenhagen University breach, however, stands out due to the sheer volume of affected individuals and the sensitivity of the compromised data, which poses a significant risk for identity fraud and sophisticated phishing attacks.
At the time of reporting, no threat actor had publicly claimed responsibility for the attack on the University of Copenhagen. The investigation into the full scope and impact of the breach is ongoing, with the university working to secure its systems and mitigate further risks to its community. The incident underscores the persistent and evolving threats faced by educational institutions globally.
The University of Copenhagen has provided an update on its data breach, confirming that the incident also exposed ID card PINs for approximately 20,000 staff and students. While this data was part of the original breach, the university delayed its disclosure until the PIN codes could be replaced. The university has since reopened affected campus locations after implementing these security measures.
The University of Copenhagen has clarified that the recent shutdown of its administrative systems, initially suspected to be a new cyberattack, is in fact linked to the previously disclosed breach. This incident, which occurred on October 20th and was disclosed on October 23rd, compromised personal data of approximately 525,000 individuals. The university also confirmed that the PIN codes for 20,000 ID cards were compromised, necessitating the issuance of new codes and temporary restrictions on physical access to certain campus locations.