The University of Copenhagen is investigating a major cybersecurity breach after hackers accessed personal information belonging to approximately 525,000 individuals. The incident also compromised thousands of campus access codes, forcing the Danish institution to introduce temporary security restrictions.
The intrusion was discovered on October 20, 2026, when the university identified unauthorized access to one of its testing environments. Although such systems are generally used for development and testing rather than everyday operations, the compromised environment contained a substantial collection of personal records.
According to the university, the exposed database included full names, Danish national identification numbers known as CPR numbers, work and personal telephone numbers, and private email addresses. Investigators are still determining which records were accessed and the full extent of the exposure.
The university publicly disclosed the breach on October 23, stating that the attackers’ access had been blocked. At that stage, officials reported no evidence that the intrusion had affected systems supporting normal academic activities or disrupted university operations.
Further investigation revealed another security concern involving approximately 20,000 students and employees. Their identification card PIN codes had also been compromised, creating potential risks for buildings and restricted areas protected by electronic access controls.
As a precaution, the university temporarily suspended physical access to selected critical locations. New PIN codes were subsequently issued to affected cardholders, allowing the restricted facilities to reopen.
The institution explained that it had delayed announcing the compromised access codes until replacements were distributed. This was intended to reduce the possibility of unauthorized individuals exploiting the information before protective measures were completed.
The exposure of CPR numbers presents a separate concern because these identifiers are widely used in Denmark for administrative and identity-related purposes. Combined with contact information, such records could help criminals create convincing phishing messages or impersonate trusted organizations.
The University of Copenhagen reported the incident to the Danish Data Protection Agency and acknowledged its obligations under the European Union’s General Data Protection Regulation. It has also promised further updates as investigators establish the scope of the breach.