UCL Erhvervsakademi og Professionshøjskole says hackers have had access to the personal data of 44,000 course participants and current and former students since March 2026.
The exposed information includes names, CPR numbers, addresses, workplaces, email addresses and phone numbers. That is according to Kristeligt Dagblad, citing Ritzau, on Wednesday, November 11.
UCL has emailed its students about the attack and urged them to make contact if they need counselling. Per the same report, the institution only became aware of the leak recently, even though the access dates back to March 2026.
The breach hit UCL’s continuing-education site
The original report came from TV 2 Fyn on the evening of November 11. The broadcaster states that the intrusion hit UCL’s continuing-education site, efteruddannelse.ucl.dk.
As reported by TV 2 Fyn, UCL has notified Datatilsynet of the breach and hired an IT security company to analyze it. UCL’s IT chief, Mads Lildholdt, puts the number of affected people at 44,000. Ritzau renders his surname as Lidholdt.
Lildholdt told TV 2 Fyn that he knows of no cases of identity theft linked to the leak so far. UCL has referred students to information about identity theft and offered counselling to those who ask for it.
Some students have asked for counselling, while others wanted insight into which data UCL stores, as noted by Ritzau. According to Lildholdt, some have asked for deletion, and UCL deletes data to the extent that it is possible.
What the UCL leak means for international students and course participants
The CPR number is the personal identification number given to everyone registered as a resident in Denmark. It is used across public services, banks, health care and higher education, so it appears in most official records about a person. Datatilsynet, the authority UCL has notified according to TV 2 Fyn, is the Danish agency that supervises data protection rules.
The affected group is not limited to people currently enrolled. Ritzau reports that it covers course participants as well as current and former students, which can include internationals who have finished a program or a continuing-education course at UCL. Requests for insight into stored data, or for deletion, go through UCL itself, which says it deletes data where that is possible.
What is not yet known is how the data has been used, or whether any of it has been shared or published. TV 2 Fyn reports that UCL’s IT chief is aware of no identity theft connected to the leak at this point. The institution’s own email directs those affected to information on identity theft and to its counselling offer.
