The University of Copenhagen in Denmark confirmed that unauthorized actors accessed one of its test environments.
This environment held personal data belonging to 525,000 individuals. The educational organization discovered the intrusion last Tuesday and made public disclosure on Friday.
Furthermore, in a recent update, the institution noted that PIN codes for an additional 20,000 staff and students were compromised. The university stated, “The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments.”
The institution, established in 1479, functions as Denmark’s oldest university and a prominent research body. It hosts around 36,800 students and 10,700 employees across six faculties and over 200 research centers.
While the investigation into the incident’s full scope continues, the University of Copenhagen advises that the exposed data heightens the vulnerability to phishing and social engineering attempts.
Concerning the PIN exposure, the University of Copenhagen has cautiously limited physical access to certain campus locations while issuing new access codes. The university reported the event to the Danish Data Protection Agency, noting it falls under the scope of Europe’s General Data Protection Regulation (GDPR) and that proper steps are being taken with regulators.
It is important to recognize that overall prevention scores may not reflect security posture once initial access is achieved, as defense effectiveness declines sharply when attackers utilize legitimate credentials.
This incident highlights operational risks associated with data environments, illustrating how breaches can occur even within non-production testing infrastructure.
