University of Copenhagen data breach: details of 525,000 people accessed

Names, identity numbers and contact details were in the database

The database holds personal data such as full name, national identity number, work and home telephone numbers and personal email address. The university is still analysing the precise extent of the breach. Its notices do not say how the hackers got in.

It says the attack was detected on Tuesday and brought under control. There is no indication that the hackers reached systems supporting day-to-day operations.

The university estimates the incident falls under the EU's General Data Protection Regulation (GDPR). It has reported the incident to the Danish Data Protection Agency.

ID card PIN codes and a precautionary shutdown followed

On 25 October the university said the attack had also compromised the PIN codes on the ID cards of approximately 20,000 staff and students. It says this is not a new breach or a new attack.

From 23 October it restricted physical access to selected critical locations on campus. They reopened once new PIN codes were issued.

On 26 October it shut down several administrative systems, including Workzone and Nimbus, as a preventive and controlled shutdown. On 27 October it said that what it first assessed as an entirely new attack was not a new attack. It says the shutdown is still necessary and remains linked to the original attack.

What it means for people and for UK organisations

The NCSC in the UK warns that criminals use breach data to make phishing emails and texts look real. If phone numbers were taken, a suspicious call may follow.

The NCSC advises checking whether you are affected through the organisation's official website or social media channels, not through links in messages. Scam messages can arrive some time after a breach is made public. In the UK, a suspicious text can be forwarded to 7726, a free service.

UK organisations have their own duties under the UK GDPR. Certain breaches must be reported to the regulator within 72 hours of becoming aware of them, where feasible. Where the risk to people is high, they must be told without undue delay.

On 10 October 2026, The Assurance Desk asked three Google AI services "we've had a data breach who do we call". The three answers cited 26 links between them, and 4 of those links were official.