University of Copenhagen breach exposes data on 525,000 people
The University of Copenhagen says attackers accessed data on about 525,000 people, including CPR numbers. Some 20,000 access PINs were also compromised.
The University of Copenhagen (KU) says attackers accessed a database holding personal data on about 525,000 people — students, staff, and former members — in an intrusion the university detected last week and reported to the Danish Data Protection Agency (Datatilsynet). The university says it has blocked the attacker's access; it has not named a threat actor.
The breach is reported by the university's own statement and by Danish outlets including DR and Ritzau, and in English by BleepingComputer. KU's own news channel carries the disclosure.
What was exposed
Per the university, the compromised database held:
- Full names
- CPR numbers (Danish national identity numbers)
- Work and private phone numbers
- Private email addresses
A later update added roughly 20,000 PIN access codes for staff and students; the student paper Omnibus reports the figure could touch up to 200,000 current and former users. BleepingComputer reports the data sat in a test environment; Danish coverage describes it as a database. CPR numbers are the sensitive item here: they're the Danish equivalent of a national ID and a reusable key across public and private services, which is why the university is reissuing physical access codes rather than just rotating passwords.
Timeline and response
- The university detected the breach on a Tuesday and says it brought the incident under control.
- Students and staff were notified roughly three days later, a lag DR reports drew criticism from security experts who argued the disclosure came too late.
- The incident has been reported to Datatilsynet and falls under GDPR.
- KU has restricted physical access to some campus locations while it issues new access codes.
What to do today
If you're a KU student, employee, or alum:
- Treat your CPR number as exposed. You can't change it, so watch for it being used in identity-fraud or loan-application attempts, and flag anything to your bank.
- Reset any password reused between KU systems and personal accounts, especially if your access PIN was among the ~20,000.
- Expect targeted phishing referencing the university — attackers holding your name, CPR, email, and phone can craft convincing lures.
Context
This is the second security incident to hit KU this year; TV 2 notes the university's Absalon course platform was compromised in May 2026. The recurring theme in large-institution breaches — data reachable in a non-production environment, late notification — is the same one that turns a contained intrusion into a mass-exposure event. The exact attack vector is not yet public; the university says its investigation into the full scope continues.