Hackers accessed an examination test environment at Denmark’s University of Copenhagen, potentially exposing personal information belonging to 525,000 people. The university discovered the breach last Tuesday, disclosed it on Friday, and said in its latest update that the PIN codes of another 20,000 staff members and students were also exposed.
“The University of Copenhagen has confirmed a cyberattack in which hackers gained access to one of the university’s examination environments,” the university said.
Personal data may have been exposed
The University of Copenhagen, founded in 1479, is Denmark’s oldest university and one of the country’s leading research institutions. It has approximately 36,800 students, 10,700 employees, six faculties and more than 200 research centers.
The university is still investigating the full scope of the incident, but warned that the compromised environment may have contained the following information:
- Full names
- Citizen identification numbers, known as CPR numbers
- Telephone numbers
- Email addresses
The exposure of this information could increase the risk of phishing and social engineering attacks. Students and faculty members whose data may have been involved should be cautious about unsolicited messages and independently verify requests before responding or sharing information.
PIN codes and campus access
In response to the exposure of PIN codes, the university has restricted physical access to certain key locations on campus. It is gradually reopening access while distributing new access codes.
The university said it has contained the attack and blocked the attacker’s access. At this time, there is no evidence that the hackers accessed systems supporting day-to-day operations or disrupted university activities.
Investigation and regulatory reporting
The University of Copenhagen has reported the incident to the Danish Data Protection Agency. It also said the breach falls within the scope of Europe’s General Data Protection Regulation (GDPR) and that it is taking appropriate steps with the relevant regulators.
The university said it will provide further updates about the extent of the impact once its internal investigation is complete.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com