University of Copenhagen breach: hackers accessed data on about 525,000 people, national ID numbers included
The University of Copenhagen said on October 23, 2026 that hackers gained access to information on approximately 525,000 individuals, including full names, national identity (CPR) numbers, telephone numbers and personal email addresses.
What happened
The University of Copenhagen said on October 23, 2026 that hackers had gained access to one of its test environments. According to the university’s statement, the attack was detected on Tuesday, October 20, 2026 and was then brought under control, and access has since been blocked. The university says there is no indication that the hackers gained access to systems supporting its day-to-day operations, and no evidence that its activities or operations have been affected. It is working to establish the full extent of the incident and to prevent similar or further attacks, and says further information will be provided once a clearer picture has emerged. The university estimates the incident falls within the scope of the General Data Protection Regulation (GDPR); it has reported the incident to the Danish Data Protection Agency (Datatilsynet) and says other relevant authorities are being kept closely informed.
Who is affected
Approximately 525,000 individuals whose information was held in the database the hackers accessed. The university says the database contains personally identifiable information: full names, national identity numbers (Danish civil registration, or CPR, numbers), work telephone numbers, home telephone numbers and personal email addresses. The university’s statement does not say which groups the 525,000 people belong to, and the university says it is still analysing the precise extent of the data breach.
How serious
The concrete risk is identity fraud built on Denmark’s national identity number. A CPR number is the identifier used to identify a person across Denmark’s public services and in dealings with private organisations, so a name paired with a CPR number, a telephone number and a personal email address gives a criminal the raw material to impersonate that person to a service that checks identity by those details, or to pass an identity check that should have stopped them. The same combination also powers targeted phishing: a message or call that quotes your real CPR number and phone number looks far more credible than a generic scam, and can be used to talk you into handing over the next thing the scammer needs. No passwords were listed among the information in the database, so this incident does not by itself hand attackers sign-ins to try against other accounts.
What to do now
Watch for the further information the university says it will provide as its analysis of the precise extent continues, and take any notice that comes through official Danish or university channels seriously. Treat unexpected calls, texts or emails that quote your CPR number, telephone number or other real details as unproven until you have checked them independently — real details in a message no longer prove the message is genuine. Go to the organisation concerned yourself, through its official site or a number you already trust, rather than using contact details supplied in the message. If you believe your CPR number has been misused, report it to the police and follow the guidance of the Danish Data Protection Agency, to which the university has reported the incident.
Sources: University of Copenhagen official statement · Nordisk Post · Daily Northern