University of Copenhagen confirms test environment breach exposing 525,000 people

Hackers entered a University of Copenhagen test environment holding personal data for 525,000 people, the Danish university confirmed, and the institution said it found the intrusion on Tuesday and disclosed it on Friday. “The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments,” the university says. A cyber attack is an attempt to gain unauthorized access to computer systems.

The university said full names, CPR national identity numbers, phone numbers and e-mail addresses may have been exposed. CPR is Denmark’s national identity number. A test environment is a system used for development or testing rather than live operations. The university listed these as categories of potentially exposed personal data.

A university update put 20,000 staff and students on the list of people with exposed PIN codes. That figure covers staff and students whose PIN codes were exposed. The update concerned PIN code exposure and came from the university. PIN codes are personal identification numbers used to verify identity. <|cite|>BleepingComputer<|/cite|>

The university warned that the exposed data heightens phishing and social engineering risk. Social engineering involves manipulating people to get information or access. It said it contained the attack and blocked the attacker’s access. The institution also said it has no sign that intruders entered systems used for day-to-day work or interrupted university operations.

Due to the PIN access exposure, the university restricted physical access to certain critical campus locations. The institution gradually reopens those locations. It also distributes new access codes to affected areas. Physical access means entry to buildings or rooms.

The Danish Data Protection Agency received a report of the incident from the university. The university said the incident falls within GDPR scope. It said it is taking appropriate steps with relevant regulators. GDPR is the European Union’s data protection regulation.

The University of Copenhagen, Denmark’s oldest university, dates from 1479. It is a leading research institution. It reports approximately 36,800 students and 10,700 employees across six faculties and over 200 research centers.

The university said its investigation into the incident’s scope remains ongoing. It pledged to share further updates on the impact scope once its internal investigation permits.

The university advises affected students and staff to be wary of unexpected messages. It also told them to confirm any requests independently. The advice is directed at potentially affected individuals. The university offered the advice in its own statement. <|cite|>BleepingComputer<|/cite|>