# University of Copenhagen breach exposes data of 525,000 people · pwn.watch > Hackers broke into a University of Copenhagen (UCPH) test environment, detected on October 20 and disclosed on October 23. The university says they obtained data on about 525,000 people: full names, Danish national identity (CPR) numbers, work and home phone numbers and personal email addresses. ID card PIN codes for about 20,000 staff and students were also compromised and have been reset. On October 26 UCPH shut down Workzone, Nimbus and other administrative systems as a precaution; it first called this a new attack, then said on October 27 it is linked to the original intrusion. UCPH says there's no sign the attackers reached systems that support day-to-day operations, and it hasn't said who was behind the attack. Page: https://pwn.watch/i/university-of-copenhagen-breach-525k-oct-2026 · generated 2026-10-27T15:23:50.295Z ## Status - Severity: high · status: live · patch: no-fix-needed - Product: University of Copenhagen (UCPH) test environment and administrative systems - Started: 2026-10-20 - Affected: About 525,000 people whose records were in a University of Copenhagen test environment; About 20,000 UCPH staff and students whose ID card PIN codes were compromised ## Follow this incident - RSS (one item per update): https://pwn.watch/i/university-of-copenhagen-breach-525k-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/university-of-copenhagen-breach-525k-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/university-of-copenhagen-breach-525k-oct-2026.json - This file: https://pwn.watch/i/university-of-copenhagen-breach-525k-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: UCPH corrects its assessment: the activity was not a new attack but is linked to the original intrusion; the shutdown stays in place and some systems are still disrupted. (https://www.ku.dk/en/operational-disruptions-at-ucph) - 2026-10-26: UCPH takes Workzone, Nimbus and other administrative systems offline in a preventive, controlled shutdown, initially describing it as a new cyberattack. (https://www.helpnetsecurity.com/2026/10/27/university-of-copenhagen-cyberattack-data-breach/) - 2026-10-25: UCPH says the PIN codes for ID cards of about 20,000 staff and students were also compromised; all were issued new PINs and the restricted locations reopened. (https://www.ku.dk/en/operational-disruptions-at-ucph) - 2026-10-23: UCPH discloses the attack: hackers obtained data on about 525,000 people, including full names, national identity (CPR) numbers, work and home phone numbers and personal email addresses. It reports the breach to the Danish Data Protection Agency and restricts physical access to selected critical campus locations. (https://news.ku.dk/all_news/2026/10/university-of-copenhagen-hit-by-cyber-attack/) - 2026-10-20: University of Copenhagen detects an intrusion into one of its test environments and brings it under control. (https://news.ku.dk/all_news/2026/10/university-of-copenhagen-hit-by-cyber-attack/) ## Fix brief # Security brief: University of Copenhagen breach exposes data of 525,000 people Source: https://pwn.watch/i/university-of-copenhagen-breach-525k-oct-2026 · status: live · severity: high · updated Oct 27, 2026, 11:56 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is Hackers broke into a University of Copenhagen (UCPH) test environment, detected on October 20 and disclosed on October 23. The university says they obtained data on about 525,000 people: full names, Danish national identity (CPR) numbers, work and home phone numbers and personal email addresses. ID card PIN codes for about 20,000 staff and students were also compromised and have been reset. On October 26 UCPH shut down Workzone, Nimbus and other administrative systems as a precaution; it first called this a new attack, then said on October 27 it is linked to the original intrusion. UCPH says there's no sign the attackers reached systems that support day-to-day operations, and it hasn't said who was behind the attack. Severity detail: National ID numbers and contact data of ~525,000 people exposed; 20,000 ID card PINs compromised - Product: University of Copenhagen (UCPH) test environment and administrative systems ## Affected versions - About 525,000 people whose records were in a University of Copenhagen test environment - About 20,000 UCPH staff and students whose ID card PIN codes were compromised ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Specific notes If you studied or worked at the University of Copenhagen: expect targeted phishing, texts and calls that quote your real name, CPR number, phone or email. Don't share codes or log in from links in unsolicited messages; verify requests through UCPH's own channels. ## Latest updates - Oct 27, 2026: UCPH corrects its assessment: the activity was not a new attack but is linked to the original intrusion; the shutdown stays in place and some systems are still disrupted. - Oct 26, 2026: UCPH takes Workzone, Nimbus and other administrative systems offline in a preventive, controlled shutdown, initially describing it as a new cyberattack. - Oct 25, 2026: UCPH says the PIN codes for ID cards of about 20,000 staff and students were also compromised; all were issued new PINs and the restricted locations reopened. - Oct 23, 2026: UCPH discloses the attack: hackers obtained data on about 525,000 people, including full names, national identity (CPR) numbers, work and home phone numbers and personal email addresses. It reports the breach to the Danish Data Protection Agency and restricts physical access to selected critical campus locations. - Oct 20, 2026: University of Copenhagen detects an intrusion into one of its test environments and brings it under control. ## Advisories - [UPDATED: University of Copenhagen hit by cyber attack](https://news.ku.dk/all_news/2026/10/university-of-copenhagen-hit-by-cyber-attack/) (University of Copenhagen) - [Operational disruptions at UCPH](https://www.ku.dk/en/operational-disruptions-at-ucph) (University of Copenhagen) ## Write-ups & news - [Cyberattack on University of Copenhagen exposes data of 525,000 people](https://www.helpnetsecurity.com/2026/10/27/university-of-copenhagen-cyberattack-data-breach/) - [University of Copenhagen data breach exposes data of 525,000 people](https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people/) ## Caveats UCPH reported the breach to the Danish Data Protection Agency (Datatilsynet) under the GDPR and is still analysing the exact scope. No group has publicly claimed the attack. --- Machine-readable: https://pwn.watch/i/university-of-copenhagen-breach-525k-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.