University of Copenhagen breach exposes personal data of about 525,000 people

On 23 October 2026, the University of Copenhagen (Københavns Universitet) — Denmark's oldest and largest university — disclosed that it had suffered a cyberattack in which intruders broke into one of its test environments. The university said the attackers obtained personal data on roughly 525,000 individuals, including names, national identity numbers, work and home phone numbers, and personal email addresses. The intrusion had been detected and brought under control on 20 October, and the university restricted access to selected campus locations on the evening it went public.

In an update on 25 October, the university said the attack had also compromised the ID-card PIN codes of about 20,000 staff and students. New codes were issued and the affected locations were reopened. The university reported the incident to the Danish Data Protection Agency, saying it believed the breach fell under the GDPR, and said it was keeping other relevant authorities informed while it worked to establish the precise extent of the exposure.

A controlled shutdown, not a second attack

On 26 October the university took several administrative systems offline — including its Workzone and Nimbus platforms — and initially said it had been hit by a new attack. The following day it revised that assessment, ruling out a second intrusion and attributing the activity to the original breach. It described the outage as a "preventive and controlled shutdown" that remained necessary despite the revised assessment. The university said there was no indication the attackers had reached the systems supporting its day-to-day operations, and no evidence its activities had been affected, though some systems continued to experience disruption.

Why it matters

Universities hold large volumes of sensitive personal data on students, staff and applicants, making them attractive targets for data-theft and extortion. No threat actor has been named and no ransom demand has been reported, and the university said it was still analysing the full scope of the breach. With access blocked and staff working to prevent further or similar attacks, the incident's status is contained, even as the investigation continues.