University of Copenhagen says hackers reached a test system with 525,000 people's data, CPR numbers included

Published 68 to 92 hours after detection: what the university says reached 525,000 people

The University of Copenhagen says its attack was detected on Tuesday 20 October 2026 and that it published its first notice at 20:05 on Friday 23 October. That is between 68 hours 6 minutes and 92 hours 5 minutes after any moment on that Tuesday (derived, because the notice gives no hour). The notice says hackers reached one of the university's test environments and gained access to information on "approximately 525,000 individuals", with full name, national identity number (the Danish CPR number), work and home telephone numbers and private email address. It says the incident was reported to the Danish Data Protection Agency.

What that does not establish is the part readers will want. It does not say when the report to the regulator was made, so it does not show whether the 72 hour rule was met. It does not say who the 525,000 are, how the attackers got in, who they are, or whether data was copied out rather than merely reachable. The word the university uses is that hackers "gained access", and "exposes" in the news site's headline is the site's word, not the university's.

The primary here is the university's own page, which carries three dated entries: 23 October at 20:05, 25 October at 20:00 and 26 October at 17:50. I read the English and Danish copies on www.ku.dk from 08:05 GMT on Tuesday 27 October 2026 and translated the Danish myself where I quote it. BleepingComputer's report of 26 October links to a copy on a different university host, news.ku.dk, which did not answer from here, so I did not read that copy. BleepingComputer's article carries a promotion for a security vendor's report, and it is used here as a pointer and for two figures only.

The story has moved twice since the first notice. On 25 October the university said ID card PIN codes for about 20,000 people had been compromised and replaced. On 26 October it said it had suffered a new hacker attack earlier that day and had shut down administrative systems. The BleepingComputer article, published the same day, repeats the first notice's line that nothing suggests daily operations were reached, and does not mention the Monday attack. Statements about this incident are ageing quickly, and every claim below is time stamped to the reading.

Stated and not stated: the university's three entries, line by line

The table sets what the university's page states against what it does not. "Not stated" means not found in the English or Danish copy I read in full. It does not mean the university does not know.

The university has a plain interest here: it is the controller of the data and the author of every line above, so its wording about what was and was not reached is a statement by the party responsible. That is not a reason to doubt it. It is a reason to note that each reassurance is dated, and that the second and third entries changed the picture the first one gave.

525,000 is eleven times the people the university usually counts

BleepingComputer quotes about 36,800 students and 10,700 employees for the university. Together that is 47,500, and 525,000 is 11.05 times that (derived). I could not read the university's own staff and student counts, because the page that carries them redirects to a host that did not answer, so those two figures are BleepingComputer's and are drawn as such.

Zoom

What the gap suggests, as inference and nothing more: the database holds many people who are not current students or staff. Applicants, former students, former staff, visitors and others are the obvious candidates, but the university names none of them. The 20,000 PIN holders are described as "some of the affected staff and students", which implies that staff and students are among those affected, and the page does not say whether the 20,000 sit inside the 525,000. BleepingComputer's phrase that the university "added another 20,000" is the reporter's reading. The university's wording is that this was not a new breach.

The Danish setting makes the field list matter. A CPR number is Denmark's national identity number, as the notice itself calls it. Denmark's CPR register announced a different incident on 5 October, which this site covered in its briefing on the 8.8 million CPR entries reached through one company, and the announcement, as BleepingComputer quotes it, warns people never to disclose passwords or confidential information in response to calls or emails, even if the caller appears to know their name, address and CPR number. A related question, how long an identity database keeps former users' CPR numbers, appears in this site's briefing on the Technical University of Denmark.

Four days, three notices, and a clock that was never shown

The first diagram sets the three entries on a time axis. The 72 hour band is derived: it marks where 72 hours after detection would end for any detection moment on the Tuesday, which is some time on the Friday. The first notice, at 20:05, falls inside that band. The page does not say when the regulator was told, only that by 20:05 on Friday it had been. The Danish regulator's guidance, read in full, adds that the 72 hours run from the controller becoming aware of a breach with reasonable certainty, not from the first sign, so detection on Tuesday does not by itself start the clock.

Zoom

Two intervals are worth stating. The second entry came 48 hours 55 minutes after the first (derived, with the clock change counted). It says the university "chose not to communicate" about the compromised ID cards until the PIN codes had been changed, and that it decided on Friday evening to restrict physical access to selected critical locations. So the first notice said nothing about the cards on the same evening that the university decided to close doors, for a reason the notice did not mention. The page gives security reasons for that choice. It also means the first notice's line that nothing suggested daily operations were reached reads differently from Sunday on.

Zoom

A student representative body told TV 2 Kosmopol, on 24 October, that students heard on Friday about an attack that happened on Tuesday, and asked for more respect and involvement. TV 2 says the university declined to comment on the criticism on Saturday. That is secondary reporting of a view, not a finding.

A test environment is a location, not a control

The phrase that does the comforting work in the first notice is "test environment" (Danish: testmiljø). It tells a reader where the data sat. It says nothing about how sensitive the data was, who could reach it, or how it was protected. On the university's own account that environment held a database with full names, CPR numbers and private contact details for about 525,000 people. A label that suggests a sandbox does not lower the risk to those people by one notch.

Other labels on the page deserve the same reading. "Brought under control" and "access blocked" state that the university acted, not what had been taken. "Preventive and controlled shutdown" on 26 October says a decision was made on purpose, which is reassuring about the response and silent about the attack. "Not a new breach" on 25 October says the PIN compromise came from the same event, which is information, but not about where the PINs were kept. The test for each phrase is whether it names a fact someone could check, and none of these does.

What the record does imply, and the page leaves for the reader to notice: the database held real personal data of the kind that production systems hold, so the test environment was not a place with fake data. Why real data was there, and whether it was copied from a live system, is not stated.

Denmark and the GDPR: what the regulator's own pages say the clock is

The Danish Data Protection Agency, Datatilsynet, says on its reporting page that a controller must report a breach "without undue delay and, where possible, within 72 hours" through Virk.dk, unless the breach is unlikely to risk people's rights and freedoms (my translation, page read 27 October 2026). Its May 2025 guidance, read in full, says the duty starts when the controller becomes aware of a breach, that a mere suspicion is not enough but should trigger a prompt investigation, and that once a quick initial inquiry gives reasonable certainty a breach has compromised personal data the controller is in general aware and must report within 72 hours. A late report must carry reasons for the delay.

Telling the individuals is a separate duty. The same guidance says controllers must also inform the people concerned when a breach is likely to carry a high risk, and that the report to the regulator is triggered by a lower bar than the notice to individuals. A public announcement can stand in for direct notice only where direct notice would take a disproportionate effort, and the controller bears the burden of showing that. The university's page is a public announcement. It does not say whether the 525,000 are being written to, and it does not argue disproportionate effort. That is an open question, not a finding of fault.

For people in the database, Datatilsynet's page for those affected says to start with the organisation responsible, and complain to the regulator only if the measures taken are unsatisfactory. It advises watching for phishing by email, SMS and phone, including messages asking for PIN codes, and says that if identity data leaks, criminals may buy goods, take loans or open mobile contracts in your name. It points to the sikkerdigital.dk hotline for identity theft. The regulator says it cannot itself help with identity theft.

The incident sits in a run of Danish incidents. TV 2 Kosmopol, quoting Ritzau, reports that on Friday 23 October the ministry for societal security and preparedness and its agency said authorities were following the incidents at Copenhagen and Aarhus universities, and quotes the minister saying the incidents again underline that the cyber threat to Denmark is serious. TV 2 reports that Aarhus University said on Thursday that a hacker reached one of its servers and tried, without success, to change passwords for about 1,700 current and former staff and students. TV 2 also reported in April 2025 that the same agency's threat assessment rated the threat of cyber espionage and of cybercrime against Danish universities as very high. Those are secondary reports of official statements, read on 27 October, and I did not locate the agency's own pages for them.

Technical details

Neither the university's pages nor the regulator's pages print any technical artifact for this incident: no hashes, domains, addresses, file or tool names, vulnerability identifiers, log lines, queries or detection rules. The attack method is not given. I have therefore invented none. What follows is the exact wording the university published about the data and the systems, which is the closest thing to a specification of what a defender and an affected person should treat as in scope.

Block one is the university's description of the data, as published on 23 October 2026 and read from www.ku.dk on 27 October 2026. It is the field list affected people should assume an attacker now holds. Translation: hackers have gained access to information on about 525,000 people; the database contains personal information such as full name, CPR number, work telephone number, home telephone number and private email address; the university is analysing the precise extent of the leak.

Hackerne har skaffet sig adgang til oplysninger på cirka 525.000 personer. Databasen indeholder personhenførbare oplysninger såsom fuldt navn, CPR-nummer, arbejdstelefonnummer, privat telefonnummer og privat e-mailadresse. Universitetet er i gang med at analysere det præcise omfang af lækket.

Block two is how the university describes the environment and the detection, in the same entry. Translation: the university has established a cyber attack in which hackers gained access to one of its test environments; the attack was discovered on Tuesday and then brought under control.

Københavns Universitet har konstateret et cyberangreb, hvor hackere har opnået adgang til et af universitetets testmiljøer. Angrebet blev opdaget tirsdag og blev herefter bragt under kontrol.

Block three is the PIN paragraph from the 25 October entry. Translation: in connection with the hacker attack, the PIN codes of some of the affected staff and students' ID cards have been compromised; this concerns about 20,000 people, who have been assigned new PIN codes. A defender reads this as a credential class, card PINs, that left the owner's control and had to be rotated at scale.

I forbindelse med hackerangrebet er PIN-koder til en del af de berørte medarbejdere og studerendes id-kort blevet kompromitteret. Det drejer sig om PIN-koder til ca. 20.000 personer, som derfor har fået tildelt nye PIN-koder.

Block four is the 26 October line on the new attack and the shutdown. Translation: this is a preventive and controlled shutdown of the administrative systems concerned, as the university was exposed to a new hacker attack earlier in the day; there may be difficulty reaching the university's websites. The page names Workzone and Nimbus as examples and does not describe either.

Det er tale om en præventiv og kontrolleret nedlukning af de pågældende administrative systemer, da universitetet tidligere på dagen blev udsat for et nyt hackerangreb. Der kan være udfordringer med at tilgå KU’s hjemmesider.

What to hunt, as this site's reading and not the university's: in any test or staging environment, list every dataset that holds a national identifier, and check whether any credential store, such as card PINs, sits outside the system that issues and verifies it. The university's account suggests both are worth asking about, and does not say whether either was the case.

What to do, in the order worth doing

Two lists follow. The first is for a person who may be in the database, ranked by how soon it matters. The second is for an organisation that holds identity data in test systems. Items in the first list rest on the regulator's own advice or on the data fields the university lists. Items in the second are this site's reading of the record and are not drawn from the university's page.

What could not be verified

• The university's other host. BleepingComputer links to news.ku.dk, and the university's other subdomains (its security pages, its staff and student fact pages) did not answer from here, so I read the www.ku.dk copies. Their wording matches BleepingComputer's quotation of the first notice. BleepingComputer also says the university warned people to be wary of unsolicited messages. That sentence is not on the www.ku.dk copies I read.
• 36,800 students and 10,700 employees. BleepingComputer's figures, not read at the university.
• When the regulator was told. Not stated anywhere I read, so whether the 72 hour rule was met cannot be assessed.
• Who the 525,000 are, how many were copied out, who the attacker is, how they got in. Not stated.
• The Aarhus University incident, the minister's statement and the 2025 threat assessment. Read only as reported by TV 2 Kosmopol. I did not find the primary pages.
• Datatilsynet's reaction to this incident. I found no statement by the regulator about it.
• Time stamped. Sources were read between 08:05 and 08:22 GMT on 27 October 2026. The university page was fetched twice and was unchanged.

The question that exposes the gap

If a test environment can hold the national identity numbers of 525,000 people and, on the university's later account, the PINs that open campus doors, which of your test systems is held to the standard of your live ones, and who signed that off?

Key facts