Cyberattack on University of Copenhagen exposes data of 525,000 people
University of Copenhagen breach exposes personal data of 525,000 people including names and ID numbers.
The University of Copenhagen confirmed a cyberattack that exposed personal data of approximately 525,000 individuals, including names, national identity numbers, phone numbers, and email addresses. The breach affected a test environment that was detected on October 20 and brought under control; additionally, PIN codes for 20,000 ID cards were compromised. The university has reported the incident to the Danish Data Protection Agency under GDPR obligations and continues investigating the scope of the breach.
AI summary of the linked source. Not reviewed by an editor. How this works
Run University of Copenhagen?
Get an email when a new story names University of Copenhagen, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe University of Copenhagen suffered a cyberattack that exposed sensitive personal data—including national identity numbers and PIN codes—of over 525,000 individuals, with the breach originating in a test environment. Test and development environments frequently hold copies of real production data yet receive far less rigorous security oversight, making them attractive and vulnerable targets. The presence of live national identity numbers and PIN codes in a test environment represents a critical data minimisation and configuration management failure. This incident underscores that non-production systems must be treated with the same security rigour as production systems, and that real personal data should never be used in testing without proper anonymisation or pseudonymisation.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.