University of Copenhagen data breach exposes data of 525,000 people

The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.

The educational organization detected the breach last Tuesday and disclosed it on Friday. In an update yesterday, the university added another 20,000 staff and students whose PIN codes were exposed.

“The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments,” the university says.

Founded in 1479, the University of Copenhagen is Denmark’s oldest university and one of its leading research institutions. It has approximately 36,800 students and 10,700 employees, with six faculties and more than 200 research centers.

The University of Copenhagen is still investigating to determine the extent of the incident, but warns that the following information may have been exposed:

• Full names
• National identity numbers (CPR)
• Phone numbers
• Email addresses

The exposed information increases the risk of phishing and social engineering attacks.

Regarding the PIN access exposure, the University of Copenhagen has restricted physical access to certain critical locations on its campus out of abundance of caution and is gradually reopening them as it distributes new access codes.

The university says it contained the attack and blocked the attacker’s access. Currently, there is no indication that hackers accessed systems supporting daily operations or disrupted university activities.

The university reported the incident to the Danish Data Protection Agency, but also said it falls within the scope of Europe’s General Data Protection Regulation (GDPR) and that it is taking the appropriate steps with the relevant regulators.

Students and staff whose data may have been exposed in this incident should be cautious of unsolicited communications and independently verify requests.

The university promised to provide more updates on the scope of the impact as soon as its internal investigation allows.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report