The University of Copenhagen (KU) has confirmed a significant data breach affecting approximately 525,000 individuals after hackers accessed a database within one of the institution’s test environments. The incident, detected on October 20, 2026, marks the third major cyberattack on a Danish university in less than 30 days, signaling a concentrated period of digital aggression against the country’s research sector.
The compromised database contained a range of sensitive personal information, including full names, personal email addresses, phone numbers, and national identity numbers, known as CPR numbers. According to Københavns Universitet, the university has reported the matter to the Danish Data Protection Agency (Datatilsynet) and has since brought the situation under control.
Physical Security Risks and Campus Lockdown
While many data breaches are confined to digital identity theft, the KU incident created immediate physical security concerns. The university confirmed on October 26 that PIN codes for approximately 20,000 physical ID cards were among the stolen data. These cards are used by staff and students to access secure campus buildings and sensitive laboratory areas.
In response to the theft of internal door codes, the university implemented a temporary physical lockdown of critical areas to prevent unauthorized entry. Despite the breach of the test environment, KU officials stated there is currently no indication that hackers successfully accessed the primary systems used for daily teaching activities or university operations.
A Pattern of Targeting Danish Academia
The breach at the University of Copenhagen follows a series of similar incidents that have left the Danish academic community on high alert. Within the same month, the Technical University of Denmark (DTU) suffered a breach affecting 200,000 users, and Aarhus University reported an attempt to compromise approximately 1,700 accounts.
The university has advised those affected to remain vigilant against unusual digital activity. The presence of live personal data in a test environment—a practice generally discouraged by cybersecurity standards—remains a point of focus as the institution reviews its internal data handling protocols.
