[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGMFgjLrNu6VTSiirrftR5YqO00vX0J9t21Ow40mR7AQ":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"e9ba6a6a-d6e3-48dc-b162-a31048935d13","Cyberattack on University of Copenhagen exposes data of 525,000 people","cyberattack-on-university-of-copenhagen-exposes-data-of-525-000-people-643709","The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data belonging to some 525,000 people. On Monday, the university took Workzone, Nimbus and other administrative systems offline in what it called “a preventive and controlled shutdown of the administrative systems in question,” warning that users might have … More → The post Cyberattack on University of Copenhagen exposes data of 525,000 people appeared first on Help Net Security.","The University of Copenhagen confirmed a cyberattack that exposed personal data of approximately 525,000 individuals, including names, national identity numbers, phone numbers, and email addresses. The breach affected a test environment that was detected on October 20 and brought under control; additionally, PIN codes for 20,000 ID cards were compromised. The university has reported the incident to the Danish Data Protection Agency under GDPR obligations and continues investigating the scope of the breach.","University of Copenhagen breach exposes personal data of 525,000 people including names and ID numbers.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F27\u002Funiversity-of-copenhagen-cyberattack-data-breach\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002F28101246\u002Fdata-breach-red.webp","2026-10-27T11:39:22+00:00","2026-10-27T12:00:11.836074+00:00",8,[17,20,23],{"name":18,"type":19},"University of Copenhagen","vendor",{"name":21,"type":22},"Workzone","technology",{"name":24,"type":22},"Nimbus","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":49,"vendors":132},[50,78,107],{"slug":51,"name":52,"problem":53,"products":54},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":73,"url":76,"description":77},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":79,"name":80,"problem":81,"products":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":108,"name":109,"problem":110,"products":111},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[112,116,124],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":40,"product_name":113,"url":114,"description":115},"CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":145},"university-of-copenhagen-breach-exposes-525000-records-via-poorly-secured-test-environment","University of Copenhagen Breach Exposes 525,000 Records via Poorly Secured Test Environment","The University of Copenhagen suffered a cyberattack that exposed sensitive personal data—including national identity numbers and PIN codes—of over 525,000 individuals, with the breach originating in a test environment. Test and development environments frequently hold copies of real production data yet receive far less rigorous security oversight, making them attractive and vulnerable targets. The presence of live national identity numbers and PIN codes in a test environment represents a critical data minimisation and configuration management failure. This incident underscores that non-production systems must be treated with the same security rigour as production systems, and that real personal data should never be used in testing without proper anonymisation or pseudonymisation.",[138,139,140,141,142,143,144],"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 3: Data Protection","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 18: Penetration Testing",{"GDPR Article 32":146,"NIS2 Article 21(2)(b)":147,"CIS Control 3: Data Protection":148,"CIS Control 18: Penetration Testing":149,"NIST SP 800-53 SI-2: Flaw Remediation":150,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":151,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":152},"Storing real national identity numbers and PIN codes in a test environment without appropriate technical safeguards such as pseudonymisation or encryption directly violates the obligation under Article 32 to implement appropriate security measures for personal data processing.","NIS2 requires entities to implement incident handling measures and appropriate security controls across all systems; a university holding data of hundreds of thousands of people must apply risk-proportionate controls even in non-production environments.","CIS Control 3 requires organisations to inventory, classify, and protect sensitive data; had this been applied, live national identity numbers and PIN codes would not have been permitted to reside unprotected in a test environment.","Regular penetration testing of all environments, including test and staging infrastructure, would likely have identified the security weaknesses in the test environment before a malicious actor was able to exploit them.","This control requires organisations to identify, report, and correct information system flaws across all operational environments, which would have mandated the same hardening standards for the test environment as for production systems.","A test environment that was left inadequately secured reflects a failure to manage technical vulnerabilities across all systems in scope; this control requires organisations to identify and remediate vulnerabilities in every environment, not just production.","Proper access controls and identity management applied to the test environment would have limited who could access the sensitive personal data stored there, reducing the blast radius of the attack."]