University of Copenhagen Breach Hits 525,000, Exposes Access PINs for 20,000

A cyberattack at the University of Copenhagen exposed personal information belonging to approximately 525,000 people, including encrypted Danish national identity numbers that the university warns could potentially be decrypted.

The university confirmed the breach on Oct. 23, saying attackers accessed a test environment containing personal data. Officials subsequently disclosed that access-card PINs belonging to approximately 20,000 students and employees were also compromised, prompting the university to replace the codes and temporarily restrict access to critical facilities.

For affected students, employees, and former university members, the breach raises concerns about identity theft and targeted phishing. For security teams, it highlights the risks of storing sensitive information in nonproduction environments.

Hackers accessed personal data belonging to 525,000 people

University IT personnel detected suspicious activity Oct. 20 and subsequently determined that attackers had gained access to a test environment containing personal information.

In its initial disclosure, the university said the compromised database contained information associated with approximately 525,000 individuals.

According to the university's official breach notification, the exposed information varies between individuals but may include:

• Names and contact details: Personal identifying information and contact information.
• University account information: University usernames and email addresses. The university's published list of compromised data does not identify account passwords.
• National identity numbers: Encrypted Danish CPR numbers.
• Personal information: Citizenship, nationality, and gender.
• University affiliations: Information about individuals' relationships with the institution.
• Access-card PINs: Codes used for physical access to university facilities.

The university explicitly confirmed that private residential addresses were not included in the compromised dataset. It also said sensitive personal information shared with the institution, including health information, was not part of the exposed records.

One particularly concerning finding involves the encrypted CPR numbers, which are used to identify individuals in Denmark. Although the identifiers were encrypted, the university warned that the information required to decrypt them was also compromised. It therefore considers there to be a significant risk that the numbers could be recovered.

The university has not confirmed that attackers successfully decrypted those identifiers.

University confirms older records were also exposed

In an Oct. 28 update, the university corrected an earlier statement about the age of the compromised records.

Officials had initially informed affected individuals that the exposed information dated back to 2002.

Further investigation revealed that some compromised records were older than 2002.

The university emphasized that this correction did not increase the number of affected individuals. It only changed the known historical range of the exposed information.

The finding means the affected dataset extends further into the university's past than initially disclosed.

University replaces PINs belonging to 20,000 people

The consequences of the attack extended beyond the exposure of personal information.

In an Oct. 25 security update, the university disclosed that PIN codes for access cards belonging to approximately 20,000 employees and students had been compromised.

The affected individuals were issued replacement PINs. As a precaution, the university temporarily restricted physical access to selected critical campus locations on Oct. 23. Those locations subsequently reopened after the replacement PINs were distributed.

The university clarified that the compromised PINs were part of the original attack disclosed Oct. 23, rather than a separate breach.

The development illustrates how compromised information can affect physical security when digital systems store credentials used to control access to buildings.

Why compromised access PINs matter

Access-card PINs can provide an additional layer of protection for buildings, laboratories, offices, and other restricted facilities.

If an attacker obtains a valid PIN and the other credentials or physical access required to use it, the code could potentially help facilitate unauthorized entry. However, the University of Copenhagen has not reported that the stolen PINs were used to gain unauthorized physical access.

Replacing the codes reduces the risk of exposure. For organizations operating physical access-control systems, the incident underscores the importance of promptly revoking compromised credentials and monitoring for suspicious entry attempts.

University rules out second attack as systems reopen

The breach also triggered precautionary shutdowns of university systems.

On Oct. 26, officials initially reported what appeared to be another cyberattack and restricted access to several administrative systems. However, in an Oct. 27 update, the university clarified that the suspicious activity was associated with the original incident and did not represent a separate attack.

Although several administrative services experienced disruptions, the university said the systems taken offline had not been compromised and were shut down as a precaution while their security was reviewed.

According to the university's operational updates, IT personnel began conducting individual security assessments before gradually restoring external access. The university identified Absalon, its learning platform, and other essential systems as priorities for restoration.

Several university systems remained restricted during recovery. The university said most students could access affected services through Eduroam on campus, while employees could use VPN to access services as they were restored.

Eduroam access to certain services was unavailable at the Niels Bohr Building, the new Natural History Museum building, and Metropol. The university directed users at those locations to wired connections, with VPN access available to employees.

Officials warned that additional service disruptions could occur during recovery. These distinctions matter because a precautionary shutdown does not necessarily indicate that attackers accessed additional systems or data.

Why the stolen information increases phishing and identity theft risks

The University of Copenhagen warned that the compromised information could be used for targeted phishing, fraudulent communications, and identity theft attempts.

The concern is particularly significant when attackers possess several pieces of information about the same person.

A criminal who knows someone's name, university affiliation, email address, and other identifying details may be able to create messages that appear to originate from a trusted institution. For example, an attacker could impersonate university IT support and claim that an account requires urgent verification following the breach.

Another potential tactic would involve fraudulent communications requesting Danish MitID information or other confidential credentials. These are potential attack scenarios, rather than confirmed examples of attacks carried out using the stolen records.

The university's guidance warns affected individuals about phishing and identity theft risks. However, the exposure of personal information does not automatically mean criminals can use it to access protected financial or government accounts.

The incident demonstrates why sensitive identifying information deserves protection even when it is not a password or payment card number.

As eSecurity Planet reported in its coverage of IDScan breach lawsuits, the exposure of personal identification information can create lasting security and privacy concerns.

What the exposed information could mean for victims

The university has not publicly identified the attackers or established their motive.

It also has not confirmed that the stolen information has been used in subsequent attacks.

University notifies affected individuals, but some cannot be contacted

The University of Copenhagen has begun notifying individuals whose information was exposed in the breach.

According to its official notification, a large proportion of affected individuals whose CPR numbers were included in the compromised data were notified through Denmark's Digital Post system on Oct. 27. The university also said it would email affected individuals for whom it had contact information on Oct. 28.

However, the university acknowledged that it could not contact everyone directly. In some cases, the compromised records contained only a person's name, leaving the institution without sufficient information to deliver an individual notification.

To address that limitation, the university made its breach notification letter publicly accessible. This means individuals who previously studied or worked at the institution should not assume they were unaffected simply because they did not receive a message.

Anyone concerned about their information should consult the university's official breach page and follow its guidance.

What affected students, employees, and former staff should do

The university has urged affected individuals to remain vigilant for suspicious communications and attempts to obtain confidential information.

Although the university has not reported confirmed misuse of the stolen records, the exposed information could make future impersonation attempts more convincing.

Affected individuals can take several steps to reduce their risk.

1. Watch for phishing messages impersonating the university

Be cautious of unexpected emails, phone calls, or text messages claiming to come from university IT staff, administrators, or other trusted organizations.

Potential warning signs include requests to:

• Confirm a university password or account credentials.
• Provide MitID information or authentication codes.
• Open an unfamiliar link to review a breach notification.
• Download software to supposedly secure an account.
• Disclose additional personal information to verify an identity.

What to do: Contact the university through its official website or established support channels, rather than using contact details provided in a suspicious message.

2. Change reused access-card PINs

The university has already replaced the compromised campus access-card PINs belonging to approximately 20,000 people.

However, anyone who reused the same PIN for another system may still face exposure.

What to do: Change that PIN wherever else it is used, including other access-control systems or services that allow the same numeric code.

Avoid using easily guessed codes or sharing access credentials with other people.

3. Protect university and personal accounts

The university's published description of the compromised information does not identify account passwords as part of the exposed dataset.

Nevertheless, the stolen data could be used to make fraudulent account-verification requests appear credible.

What to do:

• Use unique passwords for university and personal accounts.
• Enable multifactor authentication where available.
• Never approve an unexpected authentication request.
• Report suspicious login notifications to the relevant IT team.
• Avoid entering credentials through links in unsolicited messages.

Security teams should also review account-recovery procedures to ensure that exposed personal information cannot be used as sufficient proof of identity.

4. Be cautious about requests involving CPR numbers

Because the university warned that compromised CPR numbers may be decryptable, affected individuals should be particularly cautious about requests involving their national identity information.

A caller or message sender who already knows a CPR number should not automatically be considered trustworthy.

What to do: Verify sensitive requests through independently established contact channels and follow any identity-protection guidance supplied by the university or relevant Danish authorities.

5. Follow official notifications and updates

The university is continuing to investigate the incident and determine its full scope.

Individuals may have different categories of information exposed, so the exact risk will vary.

What to do: Review any official notification carefully, retain it for reference, and monitor the university's breach information page for further instructions.

Those who did not receive a notification but believe they may be affected can consult the publicly available breach notice.

Questions about the incident can be directed to the university at GDPRbreach@ku.dk.

What the breach means for university and enterprise security teams

The University of Copenhagen incident raises a broader question for organizations: How much sensitive information is stored in test environments, and are those environments protected as rigorously as production systems?

Test systems are often used to evaluate software changes, integrations, and new services before deployment.

However, when those systems contain real personal information, a compromise can expose the same sensitive records organizations are expected to protect in production.

The Copenhagen incident demonstrates that the consequences may extend beyond privacy concerns to physical access controls and operational disruption.

Security teams should consider several safeguards:

• Review test databases: Identify nonproduction environments containing real personal information, national identifiers, or access credentials.
• Minimize sensitive data: Use synthetic or appropriately anonymized data for testing wherever feasible.
• Protect encryption keys: Ensure encrypted data and the information required to decrypt it are appropriately separated and access-controlled.
• Restrict access: Limit test-environment permissions to authorized personnel and services.
• Monitor unusual activity: Apply meaningful logging, alerting, and access monitoring to nonproduction systems.
• Prepare credential replacement procedures: Establish processes for rapidly revoking compromised digital credentials and physical access codes.
• Review incident communications: Ensure employees and other affected individuals receive timely, specific guidance.

These controls are especially important for universities, healthcare organizations, financial institutions, and other institutions that retain large amounts of personal information.

eSecurity Planet has previously covered Zimbra server compromises, illustrating the importance of identifying exposed infrastructure and addressing known vulnerabilities.

Separately, its reporting on Anthropic's testing security overhaul highlights the importance of isolation and access controls in testing environments.

What happens next?

The University of Copenhagen has reported the breach to Danish authorities, including the police and Danish Data Protection Agency, and is continuing its technical investigation. It is also gradually restoring services affected by precautionary shutdowns. The university has not publicly identified the attackers or established the full extent of the consequences of the stolen information.

For affected individuals, the priority is to remain vigilant for suspicious communications, protect accounts, and follow official guidance concerning compromised identity information.

For security teams, the lesson extends beyond university systems: a test environment containing real personal data can pose significant security risks, even when investigators have found no indication that attackers have accessed operational systems.

Organizations should protect sensitive information wherever it is stored, including development, testing, and production environments.

Related reading: For another major university breach, read about a University of Phoenix cyberattack that exposed personal information of more than 3.5 million people, raising concerns about identity theft and data security in higher education.