October 23, 2026: the University of Copenhagen (Københavns Universitet, KU) said intruders reached one of its test environments, holding records on about 525,000 people. The exposed fields include full names, national identity (CPR) numbers, phone numbers and private email addresses. Canonical: university-of-copenhagen-test-env2026. Primary source: KU's news notice (Danish).
A university holds a lot of personal data about students, staff and applicants. A breach of one of its test systems matters because test environments often hold copies of real records. The CPR number is Denmark's national identity number, used across many public and private services, so it is more sensitive here than a phone number alone.
What happened
- October 20: KU detected the attack, which it says it then brought under control.
- October 23: the university announced the breach and said it had been reported to Denmark's data protection authority, Datatilsynet, under the GDPR.
- Afterwards: KU issued new ID-card PIN codes to about 20,000 staff and students whose PINs were exposed, and closed physical access to critical campus locations until those new PINs were in place.
Technical analysis
KU has not said how the attackers got in, or which software was involved. Its statement also does not establish that the attackers downloaded or published every record in the environment. It says there is no sign that the attackers reached the systems that run the university's day-to-day operations.
KU considers the incident covered by the GDPR and has reported it to Datatilsynet. That review runs separately from any action an individual takes, so the report does not change what readers should do now.
Impact
The affected records include full names, CPR numbers, work and private phone numbers and private email addresses for about 525,000 people. KU's notice lists no passwords among the data. About 20,000 staff and students had their ID-card PIN codes exposed.
The count is approximate, and sources disagree on whether the PIN group is part of the 525,000 total. Treat the figure as "about 525,000" rather than an exact count.
Verified vs unverified
- Verified (university): the test environment, the approximate 525,000 figure, the data types, the approximately 20,000 exposed PIN codes, the October 20 detection and October 23 announcement, and the report to Datatilsynet.
- Press-only and unverified: a separate report of an October 26 shutdown of administrative systems. We found no other source for it, and another report describes no sign of disrupted operations.
- Not confirmed: the entry route, the software involved, and whether the data has been published.
What to do
- Be careful with messages that quote your CPR number or phone number. Anyone holding those fields can make a call or email look legitimate.
- Do not share a PIN code with anyone who asks for it. Treat any request for your ID-card PIN by phone or email as suspicious.
- Check messages that claim to be from the university by logging in through the official site, not through a link in the message.
- If you were issued a new PIN, use it only as the university instructs, and keep it out of email and messages.
- Review your bank and identity-service accounts for activity you do not recognise, since a CPR number and contact details are often used to verify identity.
Why CPR numbers matter
Anyone who has been a student or employee at the university during the period the records cover should assume they may be in the data until KU says otherwise. KU has not said which groups are affected, so readers should assume that any group in the records could be included.
A CPR number is a permanent identifier. Unlike a password, it cannot be reset, so a leaked number stays useful to an attacker for as long as the holder remains in the system. Combined with a name and a phone number, it is enough to make an impersonation attempt look official. That is why CPR data is handled with particular care, and why the report to Datatilsynet matters.
The exposure is also a reminder that a test system is not automatically low-risk. The sources reviewed for this post do not say whether the test environment held copies of production data or synthetic records. Until the university says so, the safer assumption is that the records were real.
What the PIN exposure means
An ID-card PIN protects a physical card from misuse. KU's response, issuing new PINs and closing physical access to critical locations until the new PINs were in place, reflects that. Anyone issued a new PIN should treat the old one as compromised and use only the new one.
Sources
KU news notice (Danish) • The Copenhagen Post, October 24, 2026
Related reading
Government-held identity numbers were also exposed in Moldova this week, covered in our Moldova post. Earlier in the year, Moldova's health insurance agency was hit as well, in our CNAM post.