University of Copenhagen breach exposes personal data of more than half a million people

The University of Copenhagen confirmed that a malicious intrusion into one of its test environments resulted in the exposure of personal information belonging to roughly 525,000 individuals.

According to the university's statement, the compromised system was used for internal testing and was not part of the institution's production infrastructure. Nevertheless, it contained records that included names, contact details, and other identifiers that could be linked to students, staff, and external partners.

Cybersecurity officials said the breach was discovered during a routine audit of the university's digital assets. While the exact method of entry has not been disclosed, investigators suspect that the attackers exploited weak authentication controls that are sometimes present in non‑production environments.

University officials have alerted Danish data‑protection authorities and are working with external experts to assess the full scope of the incident. They have also begun notifying affected individuals, offering guidance on how to protect themselves from potential misuse of their data, such as phishing attempts or identity theft.

The incident adds to a growing list of high‑profile data exposures across Europe, highlighting the challenges that large research institutions face in securing both operational and testing platforms. Privacy advocates note that test environments often receive less rigorous oversight, making them attractive targets for cybercriminals seeking large datasets.

In response, the University of Copenhagen said it will tighten access controls, implement additional monitoring tools, and review its overall security architecture. The institution also pledged to conduct a thorough review of its data‑handling policies to prevent similar events in the future, while regulators are expected to evaluate whether the breach warrants further penalties under the EU’s General Data Protection Regulation.