2026 University of Copenhagen — test environment breached; records on about 525,000 people exposed (CPR numbers, phones, emails)
Data compromised
Full names, national identity (CPR) numbers, work and private phone numbers and private email addresses for about 525,000 people. KU’s notice lists no passwords. About 20,000 staff and students had ID-card PIN codes exposed and were issued new PINs; physical access to critical campus locations was closed until their new PINs were in place.
Technical writeup
KU’s October 23, 2026 announcement describes a cyberattack on a test environment holding records on about 525,000 people, and says the incident is covered by GDPR and has been reported to Datatilsynet. Sources disagree on whether the roughly 20,000 PIN cases are part of the 525,000 total; the figure is treated as approximate. KU says there is no sign the attackers reached systems that support daily operations. A gblock report of a separate October 26 shutdown of administrative systems is unverified and not included. companyConfirmed true.
Root cause
Intruders reached one of the university’s test environments. KU detected the attack on October 20, 2026, brought it under control and announced it on October 23. The university has not said how the attackers got in or which software was involved.