Denmark's largest university says a test environment gave attackers names, national identity numbers and PIN codes for 20,000 access cards.