-
Hackers entered a university test system holding names, Danish ID numbers, and contact details of 525,000 people.
-
PIN codes of about 20,000 staff and students also leaked, so the school briefly limited campus access.
-
A second attack hit the university’s administrative systems on October 26, and the school took them offline.
The University of Copenhagen in Denmark has confirmed a cyberattack on its computer systems. Reports say the attack exposed personal details of about 525,000 people. Days later, the school reported a second and separate attack on other systems.
Hackers Break Into Test System Holding 525,000 Records
The university found the break-in on Tuesday, October 20, and acted to contain it. It told the public on Friday, October 23, 2026. The official statement explains what the attackers reached.
According to the university, the attackers entered a test environment. A test environment is a separate setup that organizations use to try out systems. This one held full names. It held Danish civil registration numbers, known as CPR numbers, which act as Danish identity numbers. It held work and private phone numbers too. Personal email addresses were stored there as well. The school is still checking how much information the hackers actually saw.
The university shared an update on October 25, two days after its first announcement. It said hackers also took PIN codes linked to ID cards. A PIN code is a short secret number that proves who you are. About 20,000 staff members and students own those cards. The school gave each affected person a new PIN code. It also closed some key campus areas for a short time as a safety step. Those areas reopened after the university replaced the codes.
The university said it stopped the first attack and blocked the hackers. When it first spoke out, it saw no sign that daily systems were touched. It also saw no sign that school activities had stopped. The university reported the case to Denmark’s Data Protection Agency. It is now handling the matter under the European Union’s data law, called GDPR. GDPR is the rulebook that protects personal data across Europe.
Second Cyberattack Takes University Office Systems Offline
The situation changed again on October 26. The university reported a separate cyberattack on several administrative systems. These systems include Workzone and Nimbus, which are two of the affected tools. Administrative systems are the tools that run a school’s office work. The school took the affected systems offline as a safety step. It also warned that people might struggle to open its websites.
At first, the university reported no disruption from the first attack. The second attack forced the school to pull systems offline. As of October 27, the university had shared no more technical details about it. The school also had not linked the two incidents. Reports say the second attack came only days after the first. The October 26 report arrived six days after the school found the first break-in. Several other reports describe the system’s shutdown that followed.
Other Danish schools face similar trouble. The attacks come amid a wider cybersecurity challenge facing Danish universities. The Technical University of Denmark recently reported a breach involving data of up to 200,000 current and former users. Aarhus University reported an attempted attack involving user accounts. Both cases involve user information. A separate article asks why Danish universities attract hackers.
Cybersecurity concerns also extend beyond Denmark, with, for example, Indian schools and universities reportedly facing more than 8,000 cyberattacks every week.
These incidents show the risks for schools that store huge amounts of personal data in complex computer setups. However, the available evidence does not show that the same hackers or methods were behind these attacks.
Social Media Users Question Why Real Data Sat in a Test System
The breach started busy conversations on X about data safety in schools. These posts came from users on the platform, not from the university. Posts covered three main ideas: how long schools keep data, how well they protect it, and why real records sit in test systems.
Jobi Armstrong, posting as @jobi_armstrong, argued that schools often keep records longer than they need. The user said deleting old records could shrink the size of future breaches. User @mimohit_4u asked why real ID numbers stayed in a test system. The user also pointed out that the university has far fewer current staff and students than affected people.
Another user, @PeritumAI, highlighted the long-term privacy effects of the breach. According to the user, personal data can stay stored long after people leave a school.
User @thedoxxdoctor warned that exposed contact details could help attackers write believable phishing messages. Phishing messages are fake notes that trick people into sharing private details. The user advised affected people to verify messages on their own, instead of trusting them at once. The user also urged them to take proper identity-protection steps.
The university’s investigation continues. Until it explains how much data the hackers saw, affected people should watch for unexpected emails, calls, and messages claiming to come from the school. They should not share sensitive details or follow suspicious links before checking the request on their own. Fake emails, calls, or texts can look real, so checking the sender first helps.
