The University of Copenhagen has put a figure on last week’s intrusion: about 525,000 people had personal data taken after attackers entered one of its test environments. Detection came on October 20, and the university went public on October 23.
The exposed records include names, national identity numbers, work and home telephone numbers, and personal email addresses. UCPH said it is still working out the full scope and has reported the matter to the Danish Data Protection Agency on the basis that the GDPR applies.
A shutdown that looked like a second attack
On Monday the university took Workzone, Nimbus and other administrative systems offline, describing it at the time as a fresh compromise. By Tuesday it had reversed that assessment. Traces of activity inside the systems had resembled a new intrusion, the university said, but the shutdown stayed in place because it was still a response to the original one. Some services remain degraded.
A separate disclosure on October 25 confirmed that PIN codes for ID cards held by roughly 20,000 staff and students had been compromised. New codes were issued before the university said anything, a delay it attributed to needing the codes changed first.
UCPH maintains that core operating systems were not reached and that there is no evidence its work has been disrupted.
What to weigh now
National identity numbers are the most durable item in this trove, because Danish agencies and banks treat them as stable identifiers. Institutions holding similar registration data should assume that a test or staging system contains near-production records, and should confirm that those copies are covered by the same access controls as the live systems.
