University of Copenhagen test-environment breach exposes data of 525,000 people; second attack forces shutdown of administrative systems

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 27/10/2026 08:00 · coletado 27/10 09:01

   University of Copenhagen breach via test environment exposes PII of ~525,000 people; administrative systems shut down after second attack

   ler a análise desta fonte ocultar

   A cyber-attack on the University of Copenhagen (UCPH) compromised PII belonging to around 525,000 people after attackers accessed a test environment. The intrusion was detected on October 20 and described as brought under control, but public notification came only on October 23, with an update on October 25 saying physical access PIN codes had also been compromised. UCPH later reported a new hacker attack and a preventive shutdown of several administrative systems, contradicting its initial claim that day-to-day operations were unaffected. No threat actor had publicly claimed responsibility at the time of writing.

   Technical Details

   • Initial access was to a test environment holding a database with full name, national identity number, work and home telephone numbers and personal email address.
   • Physical access PIN codes were also exposed (the article gives the count as "20,0000", apparently a typo), so UCPH restricted access to selected critical campus locations on October 23 while resetting them.
   • The administrative systems Workzone (document management) and Nimbus (application budgeting) were disrupted by a controlled shutdown after a new attack; UCPH websites may also have been hard to reach.
   • The incident was reported to the Danish Data Protection Agency under GDPR, and other authorities were informed.
   • The exposed data could support convincing follow-on phishing and identity fraud.

   Remediation

   • UCPH reset the compromised physical access PIN codes and restricted access to critical locations.
   • Affected individuals should treat unsolicited messages that use their identity data with suspicion and watch for identity fraud.
   • Defenders should isolate test and development environments from production data and avoid holding real PII in them.
2. gbhackers.com ↗ · pub. 27/10/2026 04:44 · coletado 27/10 05:00

   University of Copenhagen breach exposes 525,000 people's data; second attack on Oct 26 forces shutdown of administrative systems

   A second hacking incident was reported on October 26, prompting controlled shutdowns of administrative systems including Workzone and Nimbus, with possible disruption to university websites. Any link to the first breach is undisclosed. The article also gives exact dates (detected Oct 20, disclosed Oct 23, PIN update Oct 25) and clarifies that the roughly 20,000 people with exposed PINs are part of the original 525,000, not an additional group.

   ler a análise desta fonte ocultar

   A second hacking incident was reported on October 26, prompting controlled shutdowns of administrative systems including Workzone and Nimbus, with possible disruption to university websites. Any link to the first breach is undisclosed. The article also gives exact dates (detected Oct 20, disclosed Oct 23, PIN update Oct 25) and clarifies that the roughly 20,000 people with exposed PINs are part of the original 525,000, not an additional group.

   The University of Copenhagen confirmed a breach of a test environment holding personal data on about 525,000 individuals. The intrusion was detected on October 20 and disclosed on October 23. An October 25 update said ID card PIN codes of about 20,000 affected staff and students were also compromised. These people are part of the original 525,000, not an additional group. On Monday, October 26, the university reported another hacking incident and shut down several administrative systems as a precaution, including Workzone and Nimbus. It has not said whether the new attack is linked to the first.

   Technical Details

   • Exposed data: full names, Danish national identity numbers, work and private phone numbers, and personal email addresses (as reported via Dark Web Informer).
   • The university has not said whether the full dataset was exfiltrated, and has not disclosed the initial access method, any exploited vulnerability or the attackers' identity.
   • The initial statement found no evidence that systems supporting daily operations were reached. That assessment applies only to the original intrusion, not to later developments.
   • The exposed PINs were used for physical access, so access to certain critical campus locations was restricted on October 23. The locations were reopened after replacement PINs were distributed.
   • The incident was reported to the Danish Data Protection Agency and other authorities, and the university treats it as subject to GDPR.
   • Combining national ID numbers with contact details raises the risk of targeted phishing and social engineering.

   Remediation

   • Affected individuals should independently verify unexpected requests, especially those asking for credentials or more personal data.
   • The university has blocked the attackers' access, contained the initial attack and issued replacement PINs.
   • Further updates are promised as the investigation progresses.
3. bleepingcomputer.com ↗ · pub. 26/10/2026 19:20 · coletado 26/10 20:00 primeiro registro

   University of Copenhagen test environment breached, exposing personal data of 525,000 people including CPR numbers

   ler a análise desta fonte ocultar

   The University of Copenhagen confirmed that attackers accessed one of its test environments holding personal data on 525,000 people. The breach was detected last Tuesday and disclosed on Friday. A later update added another 20,000 staff and students whose PIN codes were exposed. The university says it contained the attack and blocked the attacker's access. It has found no indication that systems supporting daily operations were accessed or that activities were disrupted. The investigation into the full scope is ongoing.

   Technical Details

   • Initial access vector and attacker identity have not been disclosed, and no threat actor has been named.
   • Exposed data includes Danish national identity numbers (CPR). The university warns this increases the risk of phishing and social engineering.
   • The exposed PIN codes are used for physical access to campus locations. The university restricted access to certain critical locations and is reopening them gradually as new access codes are distributed.
   • The incident was reported to the Danish Data Protection Agency and falls within the scope of GDPR.

   Remediation

   • Affected students and staff should treat unsolicited communications with caution and independently verify any requests.
   • The university is reissuing physical access codes and will publish further updates as the investigation proceeds.