MediumII Cyber Warfare & Critical Infrastructure26 October 2026, Monday
Copenhagen University breach now reaches 545,000 people
The University of Copenhagen (KU) said on 23 October that an attacker who got into a test environment had reached the data of 525,000 people, including their national identity numbers. An update added 20,000 people whose PIN codes were exposed, bringing the total to 545,000.
BleepingComputer reports that the breach was detected on Tuesday in a test environment and made public on Friday. The exposed data covers names, CPR numbers, which are Denmark's national identity numbers, along with telephone numbers and email addresses. A later update said the PIN codes of 20,000 students and staff had also been exposed. As a precaution the university restricted physical access to some critical points on campus, and is reopening them in stages as new codes are distributed.
A DR report of 23 October says KU notified the Danish Data Protection Authority (Datatilsynet). Aarhus University had announced a hack of its own a day earlier; the attacker reached a server and tried to change the passwords of about 1,700 current and former staff and students. Minister for Societal Security Lisbeth Bech-Nielsen said the two incidents showed once again how serious the cyber threat is. The identity and the method of the attacker had not been disclosed as of 26 October.
A DR report of 24 October quotes the chair of the KU Student Council criticising the fact that students were informed 3 days after the attack. A cyber security expert said the data could be used for phishing and that an earlier warning would have reduced the risk. KU is Denmark's oldest university, with about 36,800 students and 10,700 staff; the incident is being examined under the EU General Data Protection Regulation (GDPR).
Talay assessment
Bottom line
Two Danish universities hit in the same week show that the test and peripheral systems of research institutions are an easy door for attackers. The lasting damage is the exposure of national identity numbers, which cannot be changed, for more than half a million people. The most likely path is a phishing wave that runs for months and a regulatory examination under GDPR.
Likely effects
- Danish identity infrastructureNegative6 months+
Because a CPR number cannot be changed, the risk of phishing and identity fraud stays open indefinitely for 525,000 people.
- Campus physical securityNegativeWeeks
The leak of PIN codes turned a cyber breach into a physical access problem; critical points stay restricted until new codes are handed out.
- EU data protection oversightUncertain1–6 months
The 3-day notification delay and the use of real data in a test environment may become the main headings of the Datatilsynet examination.
Possibilities, ranked
- 1Phishing wave, limited enforcement55%
The leaked data is used in targeted phishing; Datatilsynet opens an examination, but any penalty process will be slow.
Watch: Phishing warnings issued in KU's name in Denmark and a statement from Datatilsynet
- 2The campaign widens30%
The same attacker turns out to have hit other Danish or Nordic universities.
Watch: A breach announcement from another university and attribution of the attacker
- 3The data is published15%
The attacker publishes the data on a leak site or demands a ransom, and the incident becomes a public crisis.
Watch: Claims of KU data appearing on leak sites
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- People affected▼ 545,000
- PIN codes exposed▼ 20,000
- Notification delay▼ 3 days