Hackers breached a test environment, exposing half‑million records
The University of Copenhagen confirmed that an unauthorized party accessed a test system that stored personal data for 525,000 individuals. Full names, Danish CPR numbers, phone numbers and email addresses were taken.
In a follow‑up notice the university added that PIN codes for another 20,000 staff and students were also exposed.
Why it matters
The data set contains identifiers that can be weaponised for identity theft, phishing or social‑engineering campaigns. Under GDPR the breach must be reported, and the university has already informed the Danish Data Protection Agency.
What the university is doing
Physical access to several critical campus locations has been locked down and new access codes are being handed out. The school says it blocked the attacker’s foothold, though independent verification has not been published.
Who is at risk
All 525,000 people whose personal details were stored – students, alumni, staff and possibly external partners – plus the 20,000 whose PINs were leaked. Anyone with a CPR number can be targeted for credential‑stuffing or fraudulent accounts.
Steps organisations can take
- Audit test and development environments; ensure they are isolated from production data.
- Encrypt any personally identifiable information at rest and in transit.
- Rotate secrets such as PINs, passwords or API keys immediately after a breach.
- Monitor for suspicious login attempts, especially using known CPR numbers.
- Educate users about phishing attempts that reference the leaked data.