University of Copenhagen Data Breach Exposes 525,000 People

Attackers reached one of the University of Copenhagen’s test environments and accessed personal data on roughly 525,000 people. The university detected the intrusion on Tuesday 20 October and disclosed it three days later. Records in the compromised database include full names, CPR numbers, work and private phone numbers, and private email addresses for each individual. The University of Copenhagen data breach therefore exposes a near-complete identity profile.

The University of Copenhagen has not said how the attackers got into the test environment behind the data breach. The university says it contained the attack and blocked the attacker’s access. Nothing so far points to intruders reaching the systems that support teaching, research and daily administration.

What the University of Copenhagen data breach exposed

Each record held five fields: full name, CPR number, work phone, private phone and private email address. CPR is Denmark’s civil registration number, the permanent identifier every resident carries from birth. That combination gives the dataset immediate criminal value.

Criminals build convincing fraud from exactly this mix of details. A caller who already knows your name, CPR number and private mobile clears the first credibility check instantly. Phishing built on the University of Copenhagen data breach can pose as a MitID prompt or a bank alert.

Why real data sat in a test environment

Test environments exist so developers can build and break things without touching live records. This one held production data on half a million people. Such systems rarely carry the monitoring, access control and logging that guard a live database. The working assumption is that nothing valuable sits inside them.

KU has not explained the presence of the records. That gap sits at the centre of the data breach the University of Copenhagen is now investigating. Regulators will press hard on it, because data minimisation rules under GDPR apply to test systems exactly as they apply to production ones.

ID card PINs forced buildings to close

The University of Copenhagen data breach also reached into physical security. An update on Sunday 25 October added ID card PIN codes for roughly 20,000 staff and students. Those people fall inside the original 525,000 rather than adding to the total.

On the evening of Friday 23 October the university closed physical access to selected critical locations on campus. KU reopened them once replacement PIN codes reached the affected cardholders. The university held that detail back until the new codes went out, citing security reasons. It called the update neither a new leak nor a second attack.

Ira Thomas Bro Pold, chair of the Student Council at the University of Copenhagen, criticised the slow communication. KU chose operational security over speed, and the criticism followed. GDPR gives organisations 72 hours to notify the supervisory authority once they become aware of a breach.

Why CPR numbers raise the long-term risk

A CPR number follows a Danish resident for life. Nobody reissues one after a leak the way a bank reissues a card. The exposure created by the University of Copenhagen data breach therefore never closes on its own. A stolen password dies the moment someone changes it, but a leaked CPR number stays useful for decades.

Danish residents have already watched these identifiers circulate at scale. Attackers enumerated the national CPR register during September 2026 and reached data on 8.8 million people. The University of Copenhagen data breach feeds directly into that accumulation. Context turns a generic scam into a targeted one.

A suspected second attack proved to be a false alarm

On Monday 26 October the university shut down several administrative systems, announcing a new cyberattack. Closer examination overnight changed that assessment. By Tuesday KU said the activity had merely resembled an attack. No second intrusion occurred beyond the data breach the University of Copenhagen disclosed on Friday.

The controlled shutdown stays in place for now regardless. KU links it to the original incident and warns that disruption continues across some systems, including access to its websites.

Where the University of Copenhagen data breach fits a Danish pattern

KU is the third Danish university to disclose an attack this month. DTU confirmed on 2 October that attackers used compromised credentials to reach its identity and access management system. That breach exposed records on up to 200,000 people going back to 2003. Aarhus University followed on 22 October, where an intruder tried to change passwords for roughly 1,700 accounts.

Danish authorities are now watching the sequence closely. The Ministry of Societal Security and Preparedness confirmed it is following the incidents at Copenhagen and Aarhus. Christina Egelund, Minister for Science, Higher Education and Digital Affairs, called the attacks a strike on Denmark’s knowledge institutions.

Universities make attractive targets for several structural reasons. They hold decades of personal records, serve a large rotating population and run open research networks by design. All three Danish cases fit that profile. The test environment at the centre of the University of Copenhagen data breach marks it out.

Regulators and the questions still open

The University of Copenhagen reported the data breach to Datatilsynet, the Danish Data Protection Agency. It says it is keeping other relevant authorities closely informed, and has confirmed that the case falls within the scope of GDPR.

Several key facts about the incident remain unknown. Nobody outside KU can say who the 525,000 people are or how the attackers got in. The university has also not said what the intruders did with the database once inside.

What people in the dataset should do now

Anyone caught in the University of Copenhagen data breach should treat unexpected contact as suspicious for months. Fraud built on this dataset will quote real information, so a correct CPR number proves nothing about the sender. Verify every request through a number or address you look up independently.

Two further steps close off the most common routes. Registering a credit alert against your CPR number through Borger.dk blocks the standard identity-fraud path in Denmark. Rejecting MitID prompts you did not trigger yourself stops account takeovers before they start.

The University of Copenhagen data breach will take weeks to map fully. KU has committed to publishing more as it learns more. For the half a million people in that database, though, the practical position is already settled. The data is out, nobody can change the identifiers inside it, and unsolicited contact deserves suspicion.