The University of Copenhagen said on Friday evening that a cyberattack gave hackers access to personal data on about 525,000 people, including full names and CPR numbers.
The breach was reported by DR, which cited a press release issued by Københavns Universitet on Friday evening. The university stated that the attackers gained access to information concerning roughly 525,000 individuals.
According to the university, the exposed data includes full names, CPR numbers, work telephone numbers, private telephone numbers and private email addresses. The attack was discovered on Tuesday and was then brought under control. The incident has been reported to Datatilsynet, the Danish Data Protection Agency, and other relevant authorities are being kept closely informed.
What is still unclear about the scope
As reported by B.T., the university said the hackers accessed a test environment. There was no indication that systems supporting daily operations were accessed. B.T. also noted that it remained unclear exactly which information had been extracted.
Per Politiken, the university is still analyzing the precise scope of the incident. It is also working to prevent similar or further attacks. The university said it had no further comment for now, but would follow up when it has a clearer picture.
Authorities say Danish universities are exposed
The Ministry for Societal Security and Preparedness and the Danish Agency for Societal Security said on Friday evening that they are following the cyber incidents at both Københavns Universitet and Aarhus Universitet. Minister for societal security and preparedness Lisbeth Bech-Nielsen of SF said, in a written comment to Ritzau, that the incidents again underline that the cyber threat against Denmark is serious.
The minister added that the Danish Agency for Societal Security generally assesses that Danish universities face a threat from cyberattacks. One reason given is that the universities lead in a number of research fields. She stated that she knows the universities are actively working to counter the threat.
Aarhus Universitet said on Thursday that it had also been targeted. According to DR, a hacker gained access to one of the university’s servers. The hacker then tried to access and change passwords for about 1,700 users, both current and former staff and students, but did not succeed, because the unauthorized access was detected.
What the data breach means for international students and staff
The CPR number is the Danish personal registration number issued to everyone who registers as a resident. It is used for banking, health care, tax matters, housing contracts and public digital services, which makes it central to daily life for foreign residents. The University of Copenhagen has stated that CPR numbers were among the data the attackers could access.
Internationals who study, teach or work at the university may be among the roughly 525,000 people covered by the incident. The university has not published a breakdown of who is affected, and B.T. reported that it is still unknown which data was actually extracted. Anyone enrolled in higher education in Copenhagen, including international degree and exchange students, should expect further information directly from the institution.
Because the breach was reported to Datatilsynet, the Danish data protection authority is now informed of the case. The university said it would follow up with more information once the picture of the incident becomes clearer. What is not yet known is whether individual affected people will be contacted, and on what timeline.
