University of Copenhagen breach exposes data on more than 525,000 people
University of Copenhagen breach exposed data on over 525,000 people, including national ID numbers and contact details.
According to the university’s notification, the attackers obtained full names, national identity numbers (CPR), phone numbers and email addresses for about 525,000 people. A later update added 20,000 staff and students whose PIN codes were exposed, TechRadar reported. The university did not name the attackers.
The university restricted physical access to critical locations on campus and redistributed new access codes, then gradually reopened the locations. Its IT team contained the attack and prevented further incursions, and the university said there was no evidence of any other compromise or disruption to other systems, according to TechRadar.
The incident was reported to the Danish Data Protection Agency. Because it falls under the General Data Protection Regulation, the university was investigating its next steps, TechRadar reported.
The university urged students, staff and partners to be wary of incoming emails. TechRadar reported that universities and other educational institutions hold information that cybercriminals find valuable, because contact details paired with private information can be used to craft tailored phishing messages. In one campaign described by TechRadar, cybercriminals told students their email addresses were due for decommission and gave them a short time, usually 24 hours or less, to confirm their identity, directing them to a fake Microsoft 365 login page that relayed credentials to the attackers.
The Copenhagen breach adds to a series of attacks on universities. TechRadar reported that the University of Pennsylvania confirmed in early November 2025 that hackers tricked an employee into sharing a PennKey SSO account and stole files on about 1.2 million students, alumni and donors. Princeton University reported a breach two weeks later involving an Advancement database containing information about alumni, donors, some faculty, students and parents. Earlier, in mid-2025, ShinyHunters broke into Canvas and said it struck more than 8,800 educational institutions in 10 countries, including Harvard, Oxford and MIT.
Editor's Summary
The University of Copenhagen has confirmed that a breach exposed personal data on more than 525,000 people and PIN codes for 20,000 staff and students. The university contained the attack, reported it to Denmark’s data protection agency and warned users about phishing. The incident follows other large breaches at universities, where contact and identity data can support tailored phishing campaigns.