Over 525,000 hit in massive University of Copenhagen data breach | Daily Reports Online
- University of Copenhagen discloses breach exposing personal data on more than 525,000 individuals
- Stolen information included names, national ID numbers, contact details, and some campus access PINs
- University contained the incident, reported it to regulators, and warned users about phishing risks
The University of Copenhagen in Denmark has confirmed suffering a cyberattack and losing sensitive data on more than half a million people.
In a notification published on the organization’s website, it was said that unnamed attackers gained access to one of its test environments, and from there, they pulled full names, national identity numbers (CPR), phone numbers, and email addresses on some 525,000 people.
A subsequent update to the announcement added another 20,000 staff and students, whose PIN codes were apparently exposed.
Latest Videos FromTechRadar
Phishing risks
The university responded by restricting physical access to critical locations on campus, and then redistributing new access codes. After that, the locations were gradually reopened. In the meantime, the university’s IT team contained the attack and prevented further incursions and said there was no evidence of any other compromise or disruptions to other systems.
The incident was then reported to the Danish Data Protection Agency, and since it falls under the jurisdiction of the General Data Protection Regulation (GDPR), the university was now investigating its next steps.
Universities and other educational institutions hold the kind of information cybercriminals find rather valuable. Contact information, paired with private information not many people know, is the kind of data threat actors can use to create tailored and personalized phishing emails.
These emails can then trick the victims into downloading infostealer malware, or granting access to systems where a ransomware deployment could be devastating.
For example, cybercriminals were seen mailing students saying their email address was due for decommission because it wasn’t used in a little while. The students were given a short timeframe (usually 24 hours or less) to “confirm their identity” or risk losing their email address, all emails stored there, as well as their entire contacts list. Obviously, that risk was never real. Victims who wanted to “confirm” their identity were redirected to a fake Microsoft 365 login page which, if they tried to log in, just relayed the credentials to the attackers.
A long list of victims
The list of universities being targeted for their data is long and ever-growing. In early November 2025, the University of Pennsylvania confirmed hackers broke in and stole files from its system.
They tricked an employee into sharing a PennKey SSO account, which gave them access to the university’s VPN, Salesforce data, Qlik analytics platform, SAP business intelligence system, and SharePoint files. Using that access, they stole data on approximately 1.2 million students, alumni, and donors, including names, dates of birth, addresses, phone numbers, estimated net worth, donation history, and demographic details.
Just two weeks later, Princeton University suffered the same fate. In a data breach notification letter sent to an undisclosed number of people, the University said threat actors accessed an Advancement database belonging to the Ivy League institution, where they were able to access information about alumni, donors, some faculty, students, parents, and other members of the organization.
The compromised database contained personally identifiable information such as names, email addresses, phone numbers, and home and business addresses. The database also contained information about fundraising activities and donations made to the university.
Earlier still, in mid-2025, infamous threat actors ShinyHunters broke into Canvas (a learning management system) and through it stole data from the world’s top universities, including Harvard, Oxford, and MIT. Stanford, Princeton, Columbia, Cambridge, Cornell, Berkeley, and Georgetown were all said to have been compromised at the same time. The attackers then said they struck more than 8,800 educational institutions in 10 different countries, including the US, Australia, the UK, and Sweden.
The University of Copenhagen is now urging its students, staff, and partners, to be wary of incoming emails.
Via BleepingComputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
