On October 23, 2026, the University of Copenhagen said an attacker accessed a test environment containing information relating to about 525,000 people. The data includes names, Danish identity numbers, phone numbers and personal email addresses. An October 25 update added access PINs for about 20,000 students and staff; the university says it replaced them.
The incident also prompted a precautionary shutdown of some administrative systems. The university later said activity that initially looked like a new attack was linked to the original incident. Public updates do not yet establish the final scope of data viewed or copied.
What the university confirmed
According to the university, attackers reached a test environment. It says this was not a system supporting day-to-day operations and that it has found no disruption to its activities. The incident was reported to Denmark’s data protection authority.
The information relates to about 525,000 people. This describes a database containing personal data; it does not prove that every person or every field was accessed. The university’s investigation still needs to clarify the number and types of people affected.
Card access PINs were also replaced
On October 25, the university disclosed that card PINs for about 20,000 students and employees had been compromised. It says it issued new codes before making that detail public. Some critical physical entrances were closed as a precaution and reopened after PIN replacement.
The university’s service status page says it shut down several administrative systems in a controlled precaution on October 26, including Workzone and Nimbus. The following day, it revised its assessment: the activity that appeared new was connected to the original incident. As of the evening of October 27, several systems remained closed to external access as a security measure. KU IT was preparing a controlled reopening after individual security assessments; the university said the closed systems had not been compromised. The restrictions were still disrupting access to some services.
Risks for people whose data was involved
A name combined with a national identity number, private contact details or an access PIN can make a phishing message seem more convincing. Criminals may reuse those details in a message pretending to come from the university. The database’s presence in the incident does not prove that all of it was extracted or published.
Students and staff should rely on university notices to learn whether they are affected. Verify unusual requests through a known channel instead of following links in an unexpected email. If you receive a replacement PIN or an account update request, confirm it with the relevant university office.
Useful checks for other organisations
The incident is a reminder that test environments can contain identifiable information. Teams should inventory the data held there, limit real data copied into testing and review access controls as carefully as they would for any system holding personal information.
Keep logs from test environments, identity systems and physical access controls available for investigation. Replacing PINs after an incident reduces further risk; it does not replace analysis of earlier access or other identifiers that may be involved.
Soclyde’s connection
An incident involving contact details and access credentials highlights the value of limiting copies and controlling business access. Soclyde lets teams keep and share secrets in an encrypted vault available on authorized devices. This can help manage a team’s own access, but it does not protect the university’s databases or replace its investigation and PIN rotation.
What to remember
The university confirmed access to a test environment, data relating to about 525,000 people and card PINs relating to about 20,000 people. The PINs have been replaced; the investigation still needs to establish the scope of the data. To review your own secret-storage practices, read our guide to creating secure passwords.
