The University of Copenhagen has confirmed a cyberattack exposing personal information belonging to 525,000 individuals.
How Did the Data Breach Occur?
The university in Denmark confirmed that hackers gained unauthorised access to one of its test environments containing personal information. The institution detected the breach last Tuesday and disclosed it on Friday.
The university is investigating the full extent of the incident and has not yet established the complete impact. It subsequently identified an additional 20,000 students and employees whose PIN codes had been exposed.
The institution, founded in 1479, has approximately 36,800 students and 10,700 employees across six faculties and more than 200 research centres.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Personal Information Was Exposed?
According to the university, the compromised environment may have contained full names, national identity numbers known as CPR numbers, telephone numbers and email addresses.
The exposure of these details raises concerns about phishing and social engineering attacks, particularly where criminals could use personal information to make fraudulent communications appear credible.
The university has advised students and employees potentially affected by the incident to exercise caution when receiving unsolicited communications and independently verify requests before responding.
What Security Measures Has the University Taken?
The university said it had contained the attack and blocked the unauthorised access. There is currently no indication that the attackers compromised systems supporting daily operations or disrupted university activities. Following the exposure of campus access PIN codes, the institution temporarily restricted physical access to certain critical locations as a precaution. Those locations are being reopened gradually as replacement access codes are distributed to affected individuals.
The university has also reported the incident to the Danish Data Protection Agency and acknowledged its obligations under Europe’s General Data Protection Regulation (GDPR).
What Happens Next in the Investigation?
The university’s internal investigation remains ongoing, with officials working to determine the full scope of the exposed information and the individuals affected. It has said further updates will be provided as the investigation establishes more details about the incident.
The420 Insight: The breach highlights the risks associated with storing personal information in test environments. Although the university reports no disruption to daily operations, the exposure of identity and contact details creates potential opportunities for phishing and impersonation attempts.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
