For: people who study or work, or used to, at the University of Copenhagen, and anyone in Denmark whose CPR number may be in the data. This article is based on consistent reports citing the university's statement, and does not cover attack techniques.
About our sources: the university's own pages could not be opened
The university's news pages on this incident (English, Danish) refused connections from this site when we tried on October 30, 2026, so we could not read them. Everything below comes from four news outlets that cite the university's statement of October 23 and its update of October 25, and that agree on the main points. Where they differ, we say so and conclude nothing. We will check the university's pages again and align this article with them.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- The exact scope and who the roughly 525,000 people are
- Whether the roughly 20,000 ID-card PIN cases are within the 525,000
- How the attacker got in
- What the October 26 system outage was (new attack or linked to the first)
- Confirmation on the university's own pages
According to the reports, the university says it is still analysing the exact scope and will say more when it knows more. Its own pages could not be read from this site on October 30.
What to do today
Do not trust a message because it knows your name and CPR number
Reports say full name, CPR number, work and private phone numbers and a private email address were obtained. A message that gets these right is therefore not proof that it is genuine.
If you get a message about "your account", "a refund", "verifying your identity" or "a security check" that mentions this incident or the university, do not click its link or call its number. Open the organisation's official website yourself and contact it there (see What is phishing?).
Never give a CPR number, password or PIN on request
Reports say the university advised caution with unsolicited messages and checking requests independently (BleepingComputer's account of the university's advice).
A caller or sender who already knows part of your CPR number can sound convincing. If anyone asks you to confirm the rest, hang up or close the message and use a number or site you find yourself.
If you have a university ID card, use only the new PIN you were given
In its October 25 update, the university said the ID-card PIN codes of about 20,000 staff and students were compromised and that all affected people had been issued new codes. Reports say physical access to selected campus locations was restricted from the evening of October 23 and reopened as new PINs were in place.
Do not reuse the old PIN anywhere. If you use the same digits for a phone, bank card or other lock, change those as well.
Treat unknown calls and texts with suspicion for a while
You can create a new email address, but a phone number is not easy to change. Leaked numbers can receive scam calls and texts for a long time, including ones that have nothing to do with the university.
Turning on your phone's spam call and text filters reduces how many get through (background: Smartphone security basics).
Use multi-factor authentication on accounts that matter
An email address plus a phone number lets a scammer try to take over accounts by "forgotten password" routes. Turn on multi-factor authentication on your main email and any account that holds money or identity data.
Watch the university's own news pages for details
The university said it would say more once it knows more. Read its news pages directly rather than through links in messages. If it contacts you, check that the message can be confirmed on its official site.
What happened (as reported, citing the university)
Dates below are from the reports. Where only one outlet gives a detail, it is named.
Tuesday, October 20, 2026
The intrusion was detected and the university says it brought the attack under control (dates from Infosecurity Magazine and Help Net Security; TV2 Kosmopol and BleepingComputer say "Tuesday").Friday, October 23 (evening)
The university announced that hackers had accessed one of its test environments and obtained data on about 525,000 people. Reports say it restricted physical access to selected critical campus locations that evening.Sunday, October 25
Update: the ID-card PIN codes of about 20,000 staff and students were compromised. All affected people were issued new codes. The university said it had waited to say so until the PINs were changed.Monday, October 26
The university shut down several administrative systems as a precaution (reports name Workzone and Nimbus among them). Infosecurity Magazine reports this as a new attack; see the note below.Tuesday, October 27
According to Help Net Security, the university said the activity that appeared to be a new attack was linked to the original attack and was not a new one. Some systems were still disrupted.
- Organisation
- University of Copenhagen (Københavns Universitet)
- Who
- Data on about 525,000 people. The reports reviewed do not break this number down by group
- Items obtained
- Full name, CPR number, work phone number, private phone number, private email address
- Also compromised
- ID-card PIN codes of about 20,000 staff and students (October 25 update); new codes issued
- Where
- One of the university's test environments
- Daily operations
- The university said there was no indication that attackers reached systems that support day-to-day operations (October 23 statement, as reported)
- Response
- Attack brought under control and access blocked; analysis of the exact scope under way; physical access to selected campus locations restricted, then reopened as new PINs were issued
- Authorities
- Reported to the Danish Data Protection Agency (Datatilsynet) under the GDPR; other relevant authorities kept informed
- Cause
- Not reported. No group had claimed responsibility in the reports reviewed
Where the reports differ, and what we conclude
The ID-card PINs and the 525,000. BleepingComputer writes that the October 25 update "added another 20,000 staff and students whose PIN codes were exposed" to the 525,000 figure, which it ties to a test environment containing personal data of 525,000 people. Help Net Security and Infosecurity Magazine give 525,000 as the first announcement's figure and describe the PINs as a separate update. No report states clearly whether the roughly 20,000 are inside the 525,000. This article treats it as not known.
The October 26 shutdown. Infosecurity Magazine reported a new attack on Monday. Help Net Security reported that the university said on Tuesday that the activity was linked to the original attack and was not new. We conclude nothing and will follow the university's statement.
TV2 Kosmopol also reports an attempted intrusion at Aarhus University the day before the announcement, which is a separate case that this article does not cover.
What is known and what is not
Status as of October 30, 2026. We will update this table as the university publishes more.
| Item | What was reported | Status |
|---|---|---|
| Hackers accessed a test environment | Stated by the university, as reported by all four outlets | Confirmed (university, as reported) |
| Detection | Tuesday, October 20 (two outlets give the date) | Confirmed (as reported) |
| People whose data was obtained | About 525,000, the first announcement's figure | Confirmed (university, as reported); exact scope under analysis |
| Full name, CPR number | Obtained | Confirmed (university, as reported) |
| Work and private phone numbers, private email address | Obtained | Confirmed (university, as reported) |
| ID-card PIN codes of about 20,000 staff and students | Compromised, new codes issued (October 25) | Confirmed (university, as reported) |
| Whether the 20,000 are included in the 525,000 | Not stated | Under investigation |
| Who the 525,000 are (students, staff, former members, others) | Not broken down in the reports | Not stated |
| Passwords, bank details, grades or medical data | Not listed among the data obtained | Not stated |
| Systems that support daily operations | No indication they were reached (October 23 statement) | Under investigation |
| The October 26 shutdown: new attack or linked to the original | Reports differ | Under investigation |
| How the hackers got in | Not reported | Under investigation |
| Who is behind it | No claim of responsibility in the reports reviewed | Not stated |
| Whether misuse of the data has been seen | Not reported | Not stated |
| A way to check individually | Not described in the reports reviewed | Not stated |
What these items can be used for in combination
A name, CPR number, two phone numbers and a private email address together are enough to write a message that looks like it came from a university, a bank, a public authority or a delivery firm. The CPR number is the item to take most seriously. In Denmark it is widely used as an identifier and cannot be changed freely, so it may be useful to a scammer for a long time. For the wider Danish context, see the 2026 misuse of Denmark's CPR register, a separate case.
Name + CPR number + email
↓→
Convincing messages that quote your name and CPR number
Fake calls and texts that use your name
→ Do not click; contact the sender via a site you find yourself
↓→
Name + phone numbers
→ Never give a CPR number, password or PIN; use spam filters
How to read it: a correct CPR number proves nothing
Many services in Denmark ask you to confirm a CPR number. After a leak, a caller who reads out your CPR number correctly is not proving who they are. Hang up and call back on a number you find yourself.
For those who run systems with personal data
The reports say the intrusion was into a test environment, yet the data obtained included real people's CPR numbers. This section covers general points this raises, not the cause of this incident, which has not been reported.
List what real personal data sits outside production
Test, staging and development copies often hold real records because it is convenient. Inventory which non-production systems hold real personal data, and treat any that do with the same controls as production: access limits, logging and monitoring.
Prefer synthetic or masked data in test environments
If the test needs realistic shapes, generate fake records or mask names and national ID numbers before copying. Then a test environment that is breached exposes far less.
Plan how fast a credential reset can be done
Here the university restricted physical access while it issued new PINs. If your system uses short codes for access, decide in advance how they are replaced for everyone, and how long that takes.
Sources (public record)
The university's own pages could not be opened from this site on October 30, 2026 (connection refused). The facts above are from the following reports, which cite the university's statements. Undisclosed methods and causes are not speculated on.
- University of Copenhagen, news page on the cyber attack (English; not readable from this site on October 30) — news.ku.dk
- University of Copenhagen, news page (Danish, marked updated; not readable from this site on October 30) — nyheder.ku.dk
- BleepingComputer, "University of Copenhagen data breach exposes data of 525,000 people" (October 26, 2026) — bleepingcomputer.com
- Infosecurity Magazine, article on the breach (October 27, 2026) — infosecurity-magazine.com
- Help Net Security, article on the breach (undated in our copy) — helpnetsecurity.com
- TV2 Kosmopol, news report (Danish; undated in our copy) — tv2kosmopol.dk
Update history
2026-10-30: First version, based on four news reports citing the university's statements of October 23 and October 25. The university's own pages could not be read from this site on that day. This article will be updated when they can be checked and when the university publishes more.
Read next
- Follow-on scams: What is phishing? / Smartphone security basics
- Protecting accounts: A guide to multi-factor authentication
- Another Danish incident involving CPR numbers: Denmark CPR register misuse (about 8.8 million people)
- Other incidents in 2026: List of data breaches and cyberattacks