University of Copenhagen Data Breach Hits 525,000 People

The University of Copenhagen data breach exposed names, CPR numbers, phone numbers and personal email addresses for about 525,000 people after attackers got into one of the university's test environments. UCPH detected the intrusion on Tuesday 20 October 2026, disclosed it on 23 October, and on 25 October confirmed that ID card PIN codes for about 20,000 staff and students were also compromised. If you run a university or any large registry, check your own test systems for real personal data this week.

What happened in the University of Copenhagen data breach

The University of Copenhagen (UCPH, Københavns Universitet) says it detected the attack on Tuesday 20 October and brought it under control. It published its first statement on the evening of Friday 23 October, confirming that "hackers gained access to one of the university's test environments" and that access had been blocked.

The same evening, after a security assessment, UCPH restricted physical access to selected critical locations on campus. That decision made sense two days later. On 25 October the university said PIN codes for some staff and student ID cards had been compromised in the same attack, affecting about 20,000 people. UCPH says it held that detail back until every affected cardholder had been issued a new PIN, then reopened the restricted locations.

On Monday 26 October UCPH shut down several administrative systems, including Workzone and Nimbus, and described it as a preventive response to a new attack. On 27 October it corrected that: the Monday activity was not a new attack but activity inside its systems that initially looked like one. The shutdown is still linked to the original incident and some systems remain disrupted.

UCPH has reported the incident to Datatilsynet, the Danish Data Protection Agency, and treats it as a GDPR personal data breach. It has made no statement on who the attackers are, whether there was a ransom demand, or how they got into the test environment.

Who is affected

The database the attackers reached holds about 525,000 individuals. UCPH lists the fields as:

full name
national identity number (CPR number)
work telephone number and home telephone number
personal email address

The university has not said which groups make up the 525,000, and Danish coverage by DR and Ritzau does not break it down either. The figure is far larger than the current student and staff population, so former students, former staff and other contacts are likely in it. Treat that as an inference until UCPH confirms it.

The 20,000 people with compromised ID card PINs are part of the same incident. Cyber Security News notes that the university describes them as a subset, so they should not be added to the 525,000.

UCPH says it has no indication that the attackers reached systems that support daily operations, and no evidence that university activities were affected.

Why a test environment matters here

The entry point is the part of this story most IT teams can act on. Test, staging and development systems tend to get weaker controls than production: shared accounts, older software, broad network access and less monitoring. They also tend to accumulate copies of production data, because a real dataset is the easiest way to test a migration or reproduce a bug.

UCPH has not explained why a test environment held real names and CPR numbers for half a million people. Whatever the reason, the result is the same as a production breach. A CPR number cannot be changed like a password, and combined with a name, phone number and email address it gives fraudsters what they need for convincing phishing and phone scams. The Danish government's own guidance after the earlier Denmark CPR register breach made the same point: a caller who knows your CPR number has not proved anything.

The fix is a data discipline problem more than a tooling problem. Test systems should hold masked or synthetic data, and the explainer on what data masking is and how it differs from encryption covers the options. If you have never checked, the guide on how to find personal data in test environments walks through an inventory.

The physical access angle

The PIN compromise is the less common part of this incident. Card-plus-PIN entry is a two-factor control for buildings: the card is something you have, the PIN something you know. Once the PINs are exposed, a lost or cloned card is enough to get in, which explains why UCPH locked down critical locations before it said anything publicly.

UCPH has not said where the PINs were stored or how the attackers obtained them. The lesson stands either way: a breach investigation that stops at IT systems can miss doors, labs and server rooms. We go into how to bring building access into incident scope in why physical access control belongs in breach scope.

Wider context in Denmark

The UCPH breach landed in the same week as an attack on Aarhus University. According to DR, Aarhus University announced on Thursday 22 October that a hacker had accessed one of its servers and tried to change passwords for about 1,700 current and former staff and students. That attempt failed because the access was detected.

Lisbeth Bech-Nielsen, Denmark's Minister for Civil Preparedness, told DR the incidents show again that the cyber threat to Denmark is serious, and that the Danish Agency for Civil Preparedness considers universities generally exposed because they lead in many research areas. Her ministry and the agency are monitoring both cases together with the ministry responsible for higher education and research.

No public source links the two university incidents to each other or to the CPR register breach confirmed on 5 October.

What to do now

If you are affected (UCPH staff, students, alumni or contacts):

Expect targeted phishing by email, SMS and phone that quotes your name and CPR number. Knowing those details does not make a caller legitimate.
Never share login codes, passwords or one-time codes with anyone who contacts you, whatever they already know about you.
If you hold a UCPH ID card, make sure you have received and set your new PIN.

If you run IT or security for a similar organization:

Inventory every non-production environment and check what data it holds. Any real national ID numbers or contact data outside production is a finding.
Replace real data in test systems with masked or synthetic data, and delete copies that no longer serve a purpose.
Put test environments behind the same identity, network and logging controls as production, or isolate them so a compromise cannot reach anything else.
Add physical access control systems to your incident response plan: who can force a PIN reset, how fast, and which doors get locked down first.
Before you rebuild compromised test systems, capture logs and disk images so the investigation can answer how the attackers got in. The steps are in our guide on preserving evidence before patching a server.

What to watch next

The open questions are how the attackers got into the test environment, whether the data has been published or offered for sale, and where the ID card PINs were held. UCPH says it is still analysing the precise extent of the breach and will share more when it has a clearer picture. Watch also for any decision from Datatilsynet, and for whether the Monday activity that forced the Workzone and Nimbus shutdown turns out to be connected to the original intruders.