The University of Copenhagen has confirmed that hackers broke into one of its test environments and gained access to personal data on approximately 525,000 people, including full names and Danish national identity numbers (CPR numbers). The breach shows how a system built for testing, rather than live operations, can still hold real personal data at a massive scale.
Denmark’s largest university said it detected the cyberattack on Tuesday, October 20, 2026, brought it under control, and disclosed it publicly on the evening of Friday, October 23. Follow-up statements over the weekend revealed that ID card PIN codes for about 20,000 staff and students were also compromised.
Real personal data inside a test environment
In its official statement, the University of Copenhagen (UCPH) said the attackers accessed a database in the test environment containing personally identifiable information on approximately 525,000 individuals. According to the university, the exposed data includes:
- Full names
- National identity numbers (CPR numbers)
- Work telephone numbers
- Private telephone numbers
- Private email addresses
The university has not said which groups make up the 525,000 records, such as current students, former students, staff or applicants. The figure far exceeds the university’s current population, which suggests the database includes records on people who are no longer active at UCPH. The university said it is still analyzing the precise extent of the breach.
UCPH has not explained why a test environment contained live CPR numbers and private contact details. Using production data in test systems is a common practice that security teams often warn against, because test environments typically receive less monitoring and weaker access controls than production systems.
ID card PIN codes reset for 20,000 people
In an update on October 25, the university disclosed that the PIN codes tied to ID cards of approximately 20,000 affected staff and students had been compromised. UCPH said this was not a new breach, and that it chose to withhold the information for security reasons until it had issued new PIN codes.
Following a security assessment, the university restricted physical access to selected critical locations on campus on the evening of October 23. UCPH said those locations reopened once the new PIN codes were in place.
False alarm triggers system shutdowns
On October 26, UCPH reported that it had been hit by a new hacker attack and began a preventive, controlled shutdown of several administrative systems, including Workzone and Nimbus. The university also warned that its websites could be difficult to reach.
In a correction published on October 27, the university said that later that evening it determined there had been no new attack, only system activity that initially appeared to indicate one. UCPH said the shutdown remains necessary because it is linked to the original cyberattack, and some systems continue to experience disruptions.
Regulators notified as students criticize the delay
The university said the incident falls within the scope of the GDPR and that it has reported the breach to the Danish Data Protection Agency (Datatilsynet). Other relevant authorities are being kept informed. The Danish Ministry of Civil Protection and Emergency Management said on October 23 that it is following the cyber incidents at both the University of Copenhagen and Aarhus University, which separately disclosed an intrusion on one of its servers that it detected on October 19. Authorities have not publicly linked the two incidents.
The three-day gap between detection and disclosure has drawn criticism. According to reports in Danish media, the chair of the UCPH Student Council said students deserved to be informed sooner, since the exposed data could be used for phishing.
No ransomware or extortion group had publicly claimed responsibility for the attack at time of publication, and the university has not said whether it received a ransom demand or whether data was copied out of the environment. UCPH said it has no further comments at this time and will share more information once it has a clearer picture.
This is the second significant data security incident at UCPH in 2026. In May, the university’s Absalon learning platform was caught up in the Instructure Canvas breach, and the incident follows the recent DTU cyberattack that exposed data of up to 200,000 students and staff at another Danish university.
What affected people should do
The combination of names, CPR numbers and private contact details gives criminals what they need for convincing phishing, smishing and impersonation scams. Anyone who has studied, worked or applied at the University of Copenhagen should:
- Treat unexpected emails, texts and calls that reference UCPH, their CPR number or university records with caution, and verify them through official university channels
- Never share MitID codes, passwords or card PINs in response to a message or call
- Watch for fraud attempts that use their CPR number, such as unexpected credit applications or account changes
- Use the new ID card PIN issued by the university if they were among the roughly 20,000 people affected
- Monitor the university’s operational disruptions page for updates on notification and next steps
