Short answer
The University of Copenhagen says attackers entered one of its test environments, which held personal data on about 525,000 people. It detected the intrusion on 20 October 2026, disclosed it on 23 October and later added that PIN codes for about 20,000 staff and students were exposed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | University of Copenhagen |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Higher education |
| Country | Denmark |
| Detected | 2026-10-20 |
| Disclosed | 2026-10-23 |
| People or records affected | About 525,000 people, plus ID-card PIN codes for about 20,000 staff and students |
What data was exposed
- Full names
- National identity numbers (CPR)
- Work and home phone numbers
- Personal email addresses
- ID-card PIN codes for about 20,000 staff and students
What happened
The University of Copenhagen, Denmark’s oldest university, says hackers broke into one of its test environments. The university detected the attack on Tuesday 20 October 2026 and brought it under control. It published a public notice on Friday 23 October.
The university says the test environment held personal data on about 525,000 people and that it was still working out the precise extent. It said it had no indication that the attackers reached the systems that support day-to-day operations. Both BleepingComputer and Infosecurity Magazine reported that no threat actor had claimed the attack.
What was exposed
According to the university, the data includes full names, national identity numbers (CPR numbers), work and home phone numbers and personal email addresses. In an update on 25 October it added that PIN codes for the ID cards of about 20,000 staff and students had also been compromised. Those cards were given new PINs.
Physical access and later disruption
Because the PINs open doors, the university restricted access to selected critical locations on campus on the evening of 23 October. Its notice says doors that once needed only a card now also require a personal PIN, with exceptions such as main entrances and reading rooms. On 3 November it introduced PIN verification for some doors.
Infosecurity Magazine also reported that a later event led the university to shut down some administrative systems as a precaution, including its document management platform Workzone and the Nimbus budgeting tool. Treat the follow-on details as still developing.
Regulator
The university reported the incident to the Danish Data Protection Agency and says it falls under the GDPR. It has promised more detail once its investigation allows.
What to do if you studied or worked there
The notice does not give a step-by-step list for individuals, but the exposed fields are the kind scammers use to sound legitimate. Expect messages that quote your name and CPR number. Contact the university through its published channels rather than replying to anything unsolicited.
This breach came days after the DTU data breach and the CPR register incident, which exposed the same type of Danish identity data. Start with our data breach checklist, and see how phishing messages use leaked details to look believable.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or texts that quote your name, phone number or CPR number to look like a real university message.
- Calls from someone posing as university IT or the police who already know your identity details and ask for passwords or a code.
- Identity fraud attempts that use your CPR number, for example loan or subscription applications in your name.
What to do if you are affected
- 01Treat any unexpected message about the university, your account or your CPR number as suspect, and check it through the university's own website.
- 02Never share passwords, MitID codes or card details with someone who contacts you first, even if they know your CPR number.
- 03Collect the new PIN code for your ID card if you are staff or a student, and stop using the old one anywhere else.
- 04Consider registering a credit alert on your CPR number via Borger.dk and read the guidance at Sikkerdigital.dk.
- 05Change any password you reuse across services, and turn on two-factor sign-in where you can.
Frequently asked questions
How many people were affected by the University of Copenhagen breach?
The university says hackers gained access to information on about 525,000 individuals. It said it was still analysing the exact extent. Separately, ID-card PIN codes for about 20,000 staff and students were compromised.
What data was exposed?
The university lists full name, national identity number, work and home phone numbers, and personal email address. It says the attackers entered a test environment, not the systems that run day-to-day operations.
Has anyone claimed the attack?
Not as of the reports we checked. BleepingComputer and Infosecurity Magazine both noted that no threat actor had publicly claimed responsibility.
Was the Danish data protection regulator told?
Yes. The university says it reported the incident to the Danish Data Protection Agency (Datatilsynet), says it falls under the GDPR, and is keeping other relevant authorities informed.
Sources
- Data breach notice (updates 23, 25 October and 3 November), University of Copenhagen, 2026-11-03
- University of Copenhagen data breach exposes data of 525,000 people, BleepingComputer, 2026-10-26
- Copenhagen University Breach Compromises Data on Half a Million People, Infosecurity Magazine, 2026-10-27
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.