Danish University Breach Exposes Data on 525,000 People After Test Environment Is Hacked

The University of Copenhagen (UCPH) has confirmed that a cyber-attack compromised sensitive personal information on about 525,000 people. The attackers got in through a test environment. The university says the database held full names, national identity numbers, work and home telephone numbers and personal email addresses. An update on October 25 added that physical access PIN codes for staff and students were also compromised.

The university detected the attack on October 20 and said it was "subsequently brought under control". Public notification came on October 23, three days later. UCPH said the incident falls within the scope of the GDPR and has been reported to the Danish Data Protection Agency. It first said there was "no indication" that systems supporting day-to-day operations were affected. It later said administrative systems, including the Workzone document management platform and the Nimbus budgeting tool, were disrupted after a new attack on Monday, and it shut them down as a controlled precaution. On October 23 it also restricted physical access to selected critical campus locations while it reset the compromised PIN codes.

The report notes that higher education institutions have long been popular targets. Cybercriminals tend to focus on stealing PII they can monetise, while nation state actors are more interested in sensitive research and intellectual property.