University of Copenhagen Data Breach Exposes 525,000 People, and 20,000 Campus PINs

The University of Copenhagen data breach has exposed personal details belonging to roughly 525,000 people, and a later update showed that about 20,000 more staff and students had their campus access PIN codes compromised. The university, Denmark’s oldest, says attackers got in through one of its test environments rather than its main operational systems.

According to the university’s notice, as relayed by BleepingComputer and TechRadar, the data that may have been exposed includes full names, Danish national identity (CPR) numbers, phone numbers and email addresses. The university detected the intrusion on a Tuesday and disclosed it that Friday. The PIN update followed a few days later.

What the attackers reached, and what they didn’t

Test environments are meant for trying out software without touching live services. They are sometimes filled with real data to make that testing realistic, which can leave sensitive records in a less protected place. The sources do not explain how the attackers got in or why real personal data was there, and the university says its investigation is still under way.

The university says it has contained the attack and blocked the intruders’ access. So far it has found no sign that systems supporting daily operations were touched or that university activities were disrupted.

Physical access was affected too

The PIN exposure gave the incident a physical side. As a precaution, the university restricted access to certain critical locations on campus. It is reopening them gradually as it hands out new access codes. The sources do not say which locations were affected or how long the restrictions lasted.

The scale is notable. The university has about 36,800 students and 10,700 employees, a combined total far below 525,000. That suggests the affected records include more than people currently enrolled or employed, possibly former students, staff or other contacts. The sources do not confirm this, and the university has not yet said who is covered.

Why phishing is the main worry

The university has reported the incident to the Danish Data Protection Agency. Because the case falls under the EU’s General Data Protection Regulation, it says it is working with the relevant regulators on next steps.

For those affected, the immediate danger is social engineering. TechRadar notes that contact details combined with private identifiers like national ID numbers let criminals write convincing, personalized phishing emails. Those messages can be used to plant infostealer malware or to gain access to systems where ransomware could later be deployed. The university advises anyone who may be affected to be wary of unsolicited messages and to verify requests independently.

The final scope of the University of Copenhagen data breach is still unclear. The university has promised more updates as its internal investigation allows, and those should show whether the numbers change and what regulators make of how the data was stored.

Explore more on this topic with Vexel Search.

File photo: 20180921 Kobenhavns universitet 001 (45153757081).jpg by Johan Wessman / News Oresund, CC BY 2.0, via Wikimedia Commons.