Threat Intelligence · Privacy
University of Copenhagen breach exposes data of 525,000 people
Hackers accessed a University of Copenhagen test system, exposing personal data of over half a million people. The university is investigating and has reported the incident to authorities.
Ross Grant2 min read
The short version
Hackers broke into a University of Copenhagen test system and accessed personal data for over half a million people. The university says some PIN codes used for building access were also exposed. The affected people have been warned to watch for suspicious messages. The university is investigating and has reported the breach to authorities.
By the numbers
- 525,000people whose data was exposedBleepingComputer
- 20,000staff and students with PIN codes exposedBleepingComputer
- 36,800current students at the universityBleepingComputer
- 10,700current employees at the universityBleepingComputer
What happened?
Hackers accessed a test environment at the University of Copenhagen, exposing personal data of 525,000 people. The breach was detected on a Tuesday and disclosed that Friday. PIN codes for 20,000 staff and students were also exposed. The university has contained the attack and is working with authorities.
Who is affected
The University of Copenhagen, Denmark’s oldest and largest university, confirmed that hackers accessed a test environment containing personal data of 525,000 people. This includes students, staff, and possibly others connected to the university. In an update, the university added that another 20,000 staff and students had their PIN codes exposed. The university has around 36,800 students and 10,700 employees, but the breach affects a much larger group, likely including alumni or applicants.
What was taken
The university said the exposed data includes personal information, though it did not specify exactly what types. For 20,000 staff and students, PIN codes used for physical access to certain locations were also exposed. The university has not said whether passwords or financial information were part of the breach.
The response
The University of Copenhagen detected the breach on a Tuesday and disclosed it publicly that Friday. After learning that PIN codes were exposed, the university restricted physical access to some critical areas on campus as a precaution. These locations are being reopened as new access codes are distributed. The university says it has contained the attack and blocked the attacker’s access. There is no sign that core systems or daily operations were disrupted. The university has reported the incident to the Danish Data Protection Agency and is working with regulators under the EU’s General Data Protection Regulation (GDPR).
What you should do
The university has advised students and staff to be cautious of unsolicited messages and to verify any requests for information. The risk of phishing and social engineering attacks is higher after such breaches, as attackers may use stolen data to trick people into revealing more information or granting access.
So far, only BleepingComputer has reported on this breach. The university is still investigating, and details about exactly what personal data was exposed have not been made public. There is no information yet about who was behind the attack or how the attackers got in. BleepingComputer (opens in a new tab)
Why it matters
This breach puts a large number of people at risk of phishing and scams. It also raises concerns about how universities protect sensitive data, even in test systems. Regulators may investigate whether the university followed data protection laws.
Key points
- Personal data of 525,000 people exposed at University of Copenhagen
- 20,000 staff and students had PIN codes for building access leaked
- The breach was in a test environment, not core systems
- University restricted access to some areas and is issuing new codes
- Incident reported to Danish and EU data protection authorities
Sources
BleepingComputer
Reference