University of Copenhagen data breach exposes data of 525,000 people

The University of Copenhagen has confirmed that hackers broke into one of its test environments and reached personal data belonging to 525,000 people. The Danish university spotted the intrusion last Tuesday and went public with it on Friday. In an update yesterday, it added another 20,000 staff and students to the tally, saying their PIN codes were exposed.

Founded in 1479, the University of Copenhagen is Denmark's oldest university and one of its leading research institutions. It enrolls roughly 36,800 students and employs about 10,700 people across six faculties and more than 200 research centers. The university said its investigation into how far the incident reaches is still underway, and it warned that the information involved may have been exposed.

The university said it has contained the attack and cut off the intruder's access. So far there is no sign that hackers reached systems supporting day-to-day operations or that university activities were disrupted. The school has reported the incident to the Danish Data Protection Agency and said it falls under Europe's General Data Protection Regulation, adding that it is taking the appropriate steps with the relevant regulators.

Because of the PIN code exposure, the university has limited physical access to certain critical campus locations as a precaution. Those locations are being reopened gradually as new access codes are handed out.

The university cautioned that the exposed information raises the risk of phishing and social engineering attacks. It advised students and staff whose data may have been caught up in the incident to be wary of unsolicited messages and to verify any requests through independent means. It promised further updates on the scope of the impact once its internal investigation allows.

For US readers, the incident is a reminder that GDPR obligations can reach American organizations handling data on European students and employees, and that exposed credentials are a common route into networks after an initial intrusion.

More cybersecurity news from TechManNews.