# University of Copenhagen data breach: details of 525,000 people accessed Names, identity numbers and contact details sat in a test system that hackers reached, and the full extent is not yet known. The Assurance Desk, news. Published 27 October 2026. The University of Copenhagen confirmed on 23 October that hackers had got into one of its test environments. They gained access to information on approximately 525,000 people ([ku.dk, Operational disruptions at UCPH, University of Copenhagen](https://www.ku.dk/en/operational-disruptions-at-ucph), checked 27 October 2026). ## Names, identity numbers and contact details were in the database The database holds personal data such as full name, national identity number, work and home telephone numbers and personal email address. The university is still analysing the precise extent of the breach. Its notices do not say how the hackers got in ([ku.dk, Operational disruptions at UCPH, University of Copenhagen](https://www.ku.dk/en/operational-disruptions-at-ucph), checked 27 October 2026). It says the attack was detected on Tuesday and brought under control. There is no indication that the hackers reached systems supporting day-to-day operations ([ku.dk, Operational disruptions at UCPH, University of Copenhagen](https://www.ku.dk/en/operational-disruptions-at-ucph), checked 27 October 2026). The university estimates the incident falls under the EU's General Data Protection Regulation (GDPR). It has reported the incident to the Danish Data Protection Agency ([ku.dk, Operational disruptions at UCPH, University of Copenhagen](https://www.ku.dk/en/operational-disruptions-at-ucph), checked 27 October 2026). ## ID card PIN codes and a precautionary shutdown followed On 25 October the university said the attack had also compromised the PIN codes on the ID cards of approximately 20,000 staff and students. It says this is not a new breach or a new attack ([ku.dk, Operational disruptions at UCPH, University of Copenhagen](https://www.ku.dk/en/operational-disruptions-at-ucph), checked 27 October 2026). From 23 October it restricted physical access to selected critical locations on campus. They reopened once new PIN codes were issued ([ku.dk, Operational disruptions at UCPH, University of Copenhagen](https://www.ku.dk/en/operational-disruptions-at-ucph), checked 27 October 2026). On 26 October it shut down several administrative systems, including Workzone and Nimbus, as a preventive and controlled shutdown. On 27 October it said that what it first assessed as an entirely new attack was not a new attack. It says the shutdown is still necessary and remains linked to the original attack ([ku.dk, Operational disruptions at UCPH, University of Copenhagen](https://www.ku.dk/en/operational-disruptions-at-ucph), checked 27 October 2026). **The university's updates so far** - 23 October, Denmark: The university confirms hackers reached one of its test environments. - 25 October, Denmark: It says PIN codes on the ID cards of approximately 20,000 people were compromised. - 26 October, Denmark: Workzone, Nimbus and other administrative systems are shut down as a precaution. - 27 October, Denmark: It says the activity first assessed as a new attack was not a new attack. Dates from the University of Copenhagen's own notices. The university is still analysing the full extent. Source: ku.dk, Operational disruptions at UCPH, University of Copenhagen, https://www.ku.dk/en/operational-disruptions-at-ucph (checked 27 October 2026) ## What it means for people and for UK organisations The NCSC in the UK warns that criminals use breach data to make phishing emails and texts look real. If phone numbers were taken, a suspicious call may follow ([NCSC, Data breach guidance for individuals](https://www.ncsc.gov.uk/guidance/data-breaches), checked 27 October 2026). The NCSC advises checking whether you are affected through the organisation's official website or social media channels, not through links in messages. Scam messages can arrive some time after a breach is made public. In the UK, a suspicious text can be forwarded to 7726, a free service ([NCSC, Data breach guidance for individuals](https://www.ncsc.gov.uk/guidance/data-breaches), checked 27 October 2026). UK organisations have their own duties under the UK GDPR. Certain breaches must be reported to the regulator within 72 hours of becoming aware of them, where feasible. Where the risk to people is high, they must be told without undue delay ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 27 October 2026). On 10 October 2026, The Assurance Desk asked three Google AI services "we've had a data breach who do we call". The three answers cited 26 links between them, and 4 of those links were official ([The Assurance Desk: AI answers on data protection on 10 October 2026, measured 10 October 2026 (data file)](https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.json), checked 27 October 2026). ## Explore the data Download the dataset or open the cited links in a spreadsheet. - [Dataset (JSON)](https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.json) - [Cited links (CSV)](https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.csv) ## Read next - [Data protection: the section](https://theassurancedesk.com/data-protection) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call) - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach) ## Sources - ku.dk, Operational disruptions at UCPH, University of Copenhagen: https://www.ku.dk/en/operational-disruptions-at-ucph (checked 27 October 2026) - NCSC, Data breach guidance for individuals: https://www.ncsc.gov.uk/guidance/data-breaches (checked 27 October 2026) - ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 27 October 2026) - The Assurance Desk: AI answers on data protection on 10 October 2026, measured 10 October 2026 (data file): https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.json (checked 27 October 2026) This is an independent editorial guide, not legal advice. --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.