University of Copenhagen: test environment breached, 525,000 people

The University of Copenhagen (UCPH), Denmark’s oldest university, has confirmed that attackers broke into one of its test environments and obtained personal data on about 525,000 people. The same attack also compromised the PIN codes of ID cards belonging to about 20,000 staff members and students. The facts are reported by BleepingComputer, Help Net Security, Infosecurity Magazine and DataBreaches.net, quoting the university’s statements.

What happened, day by day

• 20 October: the intrusion is detected and, according to the university, brought under control; the attackers’ access is blocked.
• 23 October: UCPH publicly discloses the attack on the test environment. The same evening, after a security assessment, it restricts physical access to selected locations on campus.
• 25 October: an update reveals that the attack compromised the ID card PIN codes of about 20,000 people. The university explains it withheld this for security reasons until the codes had been changed. With the new PINs in place, the closed locations reopen.
• 26 October: UCPH carries out a preventive, controlled shutdown of Workzone, Nimbus and other administrative systems, warning that its websites may be hard to reach. At first it speaks of a new attack.
• 27 October: the assessment is revised. According to the university, there was no second attack, but activity within the system that initially appeared to indicate one; the shutdown remains necessary and linked to the original attack, and some systems are still disrupted.

The university says it has no indication that the attackers reached the systems supporting day-to-day operations. The incident has been reported to the Danish Data Protection Agency, as it falls within the scope of the GDPR.

Which data

According to Help Net Security, the data includes names, national identity numbers (CPR), work and home phone numbers and personal email addresses; BleepingComputer lists the same categories more briefly. The university is still analysing the precise extent of the breach. Infosecurity Magazine refers to “over 520,000” people.

The sources differ on one point: BleepingComputer describes the 20,000 PINs as “another” group of people, while the university, quoted by Help Net Security, states that this is not a new breach compared with what was announced on 23 October. It is not clear whether those 20,000 people are included in the 525,000.

One detail worth noting: according to BleepingComputer, the university has about 36,800 students and 10,700 employees. The number of people affected is therefore far higher than the current population; the sources do not say whom the other records belong to.

What is not known

The sources do not state the access vector, the type of test environment, the attacker, or any claim of responsibility or ransom demand. No indicators of compromise have been published. Any hypothesis about the technique used would, at this stage, be speculation.

Why it matters: real data outside production

The case highlights a widespread problem. Test, staging and development environments often hold copies of production data, yet receive less attention: slower patching, shared accounts, broader access for developers or suppliers, little or no logging. If they contain real data, their value to an attacker is the same as production.

Two elements make this incident especially sensitive:

• the CPR is a permanent identifier used in Denmark for a very wide range of services; like Italy’s tax code, it cannot be “changed” like a password. The sources stress the risk of phishing and social engineering against the people affected;
• the ID card PINs link the cyber incident to physical security: the university had to close some areas and redistribute codes before reopening them.

Impact for European and Italian companies

Anyone processing personal data is bound by the same GDPR obligations: notification to the supervisory authority within 72 hours (Art. 33), communication to data subjects when the risk is high (Art. 34) and, upstream, data protection by design, minimisation and pseudonymisation (Arts. 25 and 32), which also apply to test environments. For entities in scope of NIS2 (in Italy, Legislative Decree 138/2024), a significant incident also requires an early warning to CSIRT Italia within 24 hours. Universities, research bodies and healthcare organisations, which manage large historical archives of people, are among the most exposed.

What to do now

• Inventory non-production environments (test, staging, development, training) and check which ones contain real personal data.
• Replace real data with masked, pseudonymised or synthetic data; delete old copies that are no longer used.
• Separate environments: no credentials, keys, service accounts or connections shared with production; MFA on all administrative access, test included.
• Bring test environment logs into monitoring and set alerts for bulk exports, unusual queries and access from new addresses.
• Keep physical access systems (PINs, badges) away from networks and databases reachable from test environments, and prepare a procedure to change codes quickly.
• If identifiers such as CPR or tax codes have leaked, warn the people affected about targeted phishing and explain how to verify requests through a different channel.
• In your response plan, include a controlled shutdown of systems and communication that can be corrected as you go, as UCPH did.

How ARXDOME helps

With ARX Sentry, the ARXDOME agent can also be installed on test servers: logs, security events, logins and file integrity reach the same SOC pages as production. ARX Shield shows open vulnerabilities and lets you isolate a suspicious machine, while ARX Expose flags services exposed to the internet and company accounts involved in breaches.

Last updated: 27 October 2026