University of Copenhagen Data Breach Exposes Personal Data of 525,000 People

A major data breach at the University of Copenhagen has exposed personal information of about 525,000 people. Current and former students, researchers, and staff may face increased risks of targeted phishing. Exposed data includes full names, Danish CPR identity numbers, telephone numbers, and email addresses.

The breach occurred when hackers accessed an internal test database. Officials detected the intrusion on October 20, 2026, and disclosed it on October 23. An update on October 25 confirmed that PIN codes for university access cards were exposed for 20,000 staff and students. These 20,000 people are included within the total 525,000 affected individuals.

The university restricted access to selected campus locations on October 23 while issuing replacement PIN codes. Physical access has since been restored. Campus operations continued without disruption. Officials confirmed attackers entered through a test environment, but the exact entry method remains unknown. It is not clear whether hackers downloaded all records.

Security experts warn that criminals could use exposed names and contact details for targeted phishing attacks. Messages using real personal data can appear very credible. The university reported the incident to the Danish Data Protection Agency under GDPR rules. Cybersecurity News reported the incident as investigations continue.