Hackers gained access to a University of Copenhagen test environment and obtained personal data on approximately 525,000 current and former members of the university community, the university confirmed on 23 October 2026. The attack was detected on Tuesday 20 October and has since been brought under control, with access blocked, according to the university’s own statement. The university has not said the data was sold or published.
The exposed data is wider than the first statement suggested, and one detail in it is more reassuring than it first looked. According to the university’s later updates, as reported by eSecurity Planet, the dataset includes full names, national identity numbers, work and home telephone numbers, personal email addresses, university usernames and email addresses, citizenship and nationality, gender and university affiliation, plus access-card PIN codes for about 20,000 people. The information varies by person; not everyone had every category compromised. The national identity numbers (CPR numbers) were encrypted, but the university warned that the information required to decrypt them was also compromised, creating a significant risk the numbers could be recovered. The university has not confirmed that attackers successfully decrypted them. Private residential addresses were explicitly not included in the compromised dataset.
The number reflects decades, not just today’s students
The university has about 36,800 students and 10,700 employees today, roughly 47,500 people in total, according to BleepingComputer. Our calculation puts the exposed database at 11.05 times that current population, which fits what the university later confirmed: the records cover current and former members, with the university initially telling affected people the data dated back to 2002 and then correcting that on 28 October, when further investigation showed some records were older than 2002. The incident falls within the scope of GDPR, has been reported to the Danish Data Protection Agency and the police, and the university’s technical investigation is continuing. Questions about the incident can go to the university at GDPRbreach@ku.dk.
The 20,000 PIN codes came later, and are not a second breach
Two days after the disclosure, on 25 October, the university added that the PIN codes of approximately 20,000 affected staff and students’ ID cards had been compromised, and those people were issued new PIN codes. That is 3.81% of the exposed population, by our calculation. The university stated explicitly that the PIN-code matter “is not a new data breach or a new cyberattack”, explaining that communication was held until the PIN codes had been changed. On the evening of Friday 23 October, following a security assessment, the university restricted physical access to selected critical locations on campus; once new PIN codes were issued, those locations were reopened.
The three-day gap between detection on 20 October and disclosure on 23 October drew criticism in Danish media. The student council chair told TV 2 Kosmopol that students should have been informed sooner, and a cybersecurity expert told DR that the university could have warned people sooner while investigating, as reported by Danish Dispatch. The university’s published updates end with the note that it has no further comments at this time.
The “second attack” was not a second attack
On Monday 26 October, the university initially reported what appeared to be another cyberattack and shut down administrative systems including Workzone and Nimbus in what it called a preventive, controlled shutdown. On Tuesday 27 October it corrected that assessment, according to its operational-disruptions update: the activity was not a new attack but activity within the system that initially appeared to indicate one, and the shutdown remains linked to the original cyberattack. The closed systems were not compromised, the university emphasised, but were shut down as a precaution; as of the 27 October evening update, a number of systems remained closed to external access, with the Absalon learning platform among the priorities for restoration.
For anyone who may be among the 525,000, the practical risk is phishing and social engineering: the exposed details are exactly the kind used to craft convincing messages. Treat unexpected messages asking for personal details or credentials with suspicion, and verify through a known channel before responding. This is a separate incident from Denmark’s earlier CPR registry breach, which involved a different system and a different route of access.
Photo: Per Meistrup, CC BY-SA 4.0, via Wikimedia Commons.
