University of Copenhagen Breach Exposes 525,000 People's ID Numbers

The University of Copenhagen in Denmark has confirmed that it suffered a cyberattack in which the personal data of more than half a million people was stolen. According to an announcement on the university's website, unidentified attackers gained access to one of the institution's test environments and pulled data from it.

The stolen data includes the full names, Danish national ID numbers (CPR), phone numbers and email addresses of roughly 525,000 people, the notice said. An updated version of the announcement indicates that the campus access PIN codes of about 20,000 staff members and students were also exposed.

How the university responded

After the breach, the university restricted physical access to critical areas of the campus and issued new access codes. Those areas were then reopened in stages. The IT team said it has contained the attack and is blocking new intrusion attempts, adding that it has found no evidence of a breach or disruption in other systems.

The incident has been reported to the Danish Data Protection Agency. Because it falls under the European Union's General Data Protection Regulation (GDPR), the university is now assessing what further steps it must take.

Phishing risk and fake emails

The university is urging students, staff and partners to be cautious about incoming email. The data held by educational institutions is valuable to cybercriminals: when contact details are combined with private information that is not widely known, they can form the basis of tailored phishing messages. Such emails can push victims into downloading information-stealing malware or granting access to systems that are open to ransomware attacks.

One example from phishing campaigns aimed at educational institutions told students that long-unused email addresses were about to be shut down and typically demanded identity verification within 24 hours or less. Those who tried to verify were sent to a fake Microsoft 365 login page, and whatever they entered went straight to the attackers. The threat of closure was not real.

Universities remain a prime target

The Copenhagen incident adds to a long list of attacks on educational institutions. In early November 2025, the University of Pennsylvania confirmed that attackers had got in by compromising an employee's PennKey SSO account. They reached VPN, Salesforce, Qlik, SAP and SharePoint data and stole the information of about 1.2 million students, alumni and donors.

About two weeks later, Princeton University had a similar incident, with a database containing names, emails, phone numbers and addresses linked to alumni, donors, some faculty, students and parents being accessed. In mid-2025, a group called ShinyHunters was said to have broken into the Canvas learning management system and stolen data from many universities, including Harvard, Oxford and MIT. The attackers claimed to have affected more than 8,800 educational institutions across 10 countries, among them the US, Australia, the UK and Sweden.