The University of Copenhagen in Denmark says hackers got into one of its test environments, which held personal data belonging to 525,000 people. According to BleepingComputer, the university detected the breach on Tuesday, October 20, and disclosed it three days later. The university says it has contained the attack and blocked the attacker’s access, and that it has no indication that systems supporting daily operations were reached or that university activities were disrupted.
The university says the exposed information may include full names, Danish national identity numbers (CPR), phone numbers and email addresses. BleepingComputer reports that an update added about 20,000 more staff and students whose PIN codes were exposed. As a precaution, the university restricted physical access to certain critical locations on campus and is reopening them gradually as it hands out new access codes. It reported the incident to the Danish Data Protection Agency and says it is taking the steps required under the GDPR.
The investigation into the full extent of the breach is still running, and the university has promised further updates. Because names, ID numbers, phone numbers and email addresses are exactly what scammers need to make a message look legitimate, the university warns that the exposure raises the risk of phishing and social engineering. Anyone who studies or works there should treat unsolicited messages with caution and verify requests independently, using contact details taken from the university’s own website rather than from the message.
Sources
- University of Copenhagen data breach exposes data of 525,000 people - BleepingComputer
- University of Copenhagen: “Hit by cyber attack” - the university’s announcement, linked from the BleepingComputer article; the page did not load when we checked, so the facts above are as reported by BleepingComputer