The University of Copenhagen (UCPH), Denmark's oldest and largest university, has confirmed that attackers got into one of its test environments. The environment held a database of personal data on about 525,000 people. The university's own announcement gives the 525,000 figure, as do BleepingComputer, DR, TV 2 and Aarhus University's Omnibus. Computerworld Denmark gives 535,000. No other source supports that number, and it may be a typo, but it has not been corrected. In a follow-up on 25 October, the university said the PIN codes on ID cards belonging to about 20,000 staff and students had also been compromised. It temporarily locked down critical locations on campus while it reissued the codes.
What Happened
- Detection (Tuesday 20 October): UCPH says it detected the intrusion on Tuesday and then brought it under control. It says the attackers' access has been blocked.
- Public disclosure (Friday 23 October, 20:05): The university announced the attack three days after detecting it. That evening it also restricted physical access to selected critical campus locations after what it called a security assessment.
- PIN code update (Sunday 25 October, 20:00): UCPH disclosed that ID card PIN codes for about 20,000 people had been compromised and that new codes had been issued. The university says this "is not a new data breach or a new cyberattack." It says it held back this detail until the codes had been changed. Once the new codes were out, the restricted locations reopened.
- Possible second incident: A separate, undated UCPH page on operational disruptions says the university carried out a "preventive and controlled shutdown" of administrative systems, including Workzone and Nimbus, because UCPH "was exposed to a new hacker attack earlier Monday." The page does not say which Monday. It also does not explain how this event relates to the test environment breach, and none of the press coverage reviewed here mentions it. Treat it as unconfirmed until UCPH clarifies.
UCPH says there is no sign that the attackers reached systems that support day-to-day operations, and no evidence that university activities were disrupted. It has reported the incident to the Danish Data Protection Agency (Datatilsynet) and says the incident falls under GDPR.
The delay in disclosure has drawn criticism. Ira Thomas Bro Pold, chair of the UCPH Student Council, told TV 2 Kosmopol that the three-day gap was unacceptable. Cybersecurity expert Sofie Freja Christensen told DR that the university could have notified people faster once the incident was contained. She also noted that disclosure timing should rest on a risk assessment.
What Was Taken
UCPH says the compromised database contains:
- Full names
- CPR numbers (Danish national identity numbers)
- Work telephone numbers
- Home or private telephone numbers
- Personal email addresses
Separately, ID card PIN codes for about 20,000 staff and students were compromised. These cards control physical access to university buildings. Sources describe them differently: UCPH and BleepingComputer say "PIN codes," Omnibus says "passwords," and Computerworld says "adgangskoder" (access codes). The university's own wording is PIN codes for ID cards. No source says whether login credentials for IT systems were affected.
The 525,000 figure is far larger than UCPH's current population of about 36,800 students and 10,700 employees. The database therefore almost certainly includes former students, former staff, applicants or other affiliates. UCPH says it is still working out the exact scope and has not yet said which groups are affected.
The CPR number is the most sensitive item. In Denmark it is a lifelong identifier used across government, banking and healthcare, and it cannot easily be changed.
Why It Matters
- Test environments are being treated as low-risk: Production-scale personal data, including national ID numbers, appears to have been stored in a non-production system. Test environments often get weaker access controls, less monitoring and slower patching than production.
- The breach reached physical security: Card PIN codes in the same compromise forced UCPH to restrict access to critical locations on campus. Identity data and physical access control were linked closely enough that one intrusion affected both.
- Several Danish universities have been hit: According to Omnibus, UCPH is the third Danish university attacked in October 2026. An attack on DTU reportedly exposed data on about 200,000 people. An attack on Aarhus University reached 1,700 user IDs but was stopped before those accounts were compromised. TV 2 also reported a multi-hour Moodle outage affecting students at several institutions, including Roskilde University. No source attributes these incidents to a common actor.
- Phishing risk is high: Names, CPR numbers, phone numbers and personal email addresses together are enough for convincing impersonation of the university, banks, SKAT or MitID.
The Attack Technique
The initial access vector has not been disclosed, and no threat actor has claimed or been named for the attack. TV 2 lists among its open questions whether the attack is related to "the extensive PHP security flaw" reported earlier. That is a question raised by journalists, not a confirmed finding. No source links the breach to a specific CVE. What is confirmed is narrow: the attackers reached a server that hosted the database in a test environment, and access has since been cut off.
What Organizations Should Do
- Inventory non-production data. Find every test, staging and development environment that holds real personal data, and replace that data with masked or synthetic data. National ID numbers should never sit in a test system.
- Apply production-level controls to test environments. Use the same patching cadence, network segmentation, MFA and logging. Attackers look for the least-defended copy of the data.
- Separate physical access credentials from identity databases. Card PINs should not be stored in readable form alongside personal data. Keep a runbook ready for rotating PINs in bulk at short notice.
- Patch internet-facing PHP and web stacks promptly, given the open questions about a PHP-related vector. Hunt for webshells on exposed application servers.
- Prepare for a fast first disclosure. A short, early notice followed by updates usually draws less criticism than three days of silence. Affected people need time to watch for fraud.
- Warn affected people about targeted phishing. Tell them the university will never ask for their CPR number or credentials by email or SMS, and tell them to verify any unsolicited request independently.
Sources: University of Copenhagen data breach exposes data of 525,000 people | UPDATED: University of Copenhagen hit by cyber attack – University... | Operational disruptions at UCPH - University of Copenhagen | Københavns Universitet får kritik for håndtering af cyberangreb In... | Københavns Universitet ramt af hackerangreb: 525.000 personer ramt... | Studerende kan igen finde pensum efter nedbrud - TV 2 | University of Copenhagen also hit by cyberattack | Tip os om hackerangrebet - TV 2