University of Copenhagen Data Breach Exposes 525,000 People’s Personal Data, Including Phone Numbers

The University of Copenhagen has confirmed a data breach that exposed personal information belonging to about 525,000 people after hackers accessed a university test environment.

The affected database contained full names, Danish national identity numbers, work and private telephone numbers, and personal email addresses. The university is still examining the full extent of the exposure.

The attack was detected on October 20, 2026, and publicly disclosed on October 23. According to the university’s official security notice, the university has brought the incident under control and blocked the attackers’ access.

According to reports, the October 25 update confirmed the exposure of ID card PINs belonging to around 20,000 staff and students, with no evidence of disrupted university operations.

The university issued replacement codes and confirmed that this finding was part of the original incident, not a separate attack. It delayed announcing the compromised codes until it changed them.

University of Copenhagen Data Breach Exposes

The university restricted access to selected critical campus locations on October 23, reopening them after replacing affected PIN codes, as the investigation expanded to physical access control data.

The university should not add the 20,000 affected cardholders to the reported 525,000 people as a separate group. The university described them as affected staff and students within the same incident, rather than announcing a new total.

The confirmed entry point was a test environment. However, the university has not disclosed how the hackers gained access, which software was involved, or whether stolen login details or a software flaw enabled the intrusion. Its statement also does not establish that the hackers downloaded or published every exposed record.

The incident highlights the risks of keeping real personal information in testing systems. A related University of Sydney data breach involved historical personal records stored in an online code library intended for software development. That case similarly placed sensitive information inside a development resource.

A separate Dell test platform breach offers a useful contrast. Dell said its affected demonstration environment mainly contained synthetic data and was separated from customer systems. These cases illustrate why the contents and boundaries of test systems matter when assessing a breach’s impact.

The exposed identity and contact details could support targeted phishing and social engineering. Messages that include a person’s real name or other private details may appear credible, so affected people should independently verify unexpected requests rather than trust the information included in them.

The university has reported the incident to the Danish Data Protection Agency and is keeping other relevant authorities informed. It says the breach falls within the scope of GDPR and continues to investigate its extent. Further updates are expected once investigators establish a clearer picture of what happened and which information was affected.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post University of Copenhagen Data Breach Exposes 525,000 People’s Personal Data, Including Phone Numbers appeared first on Cyber Security News.