University of Copenhagen Shuts Down Systems as Breach Impact Expands to 525,000 People

The University of Copenhagen has confirmed that suspicious activity detected this week was not the result of a second cyberattack, but was instead linked to the major breach disclosed days earlier that exposed personal data belonging to approximately 525,000 individuals.

On Monday, the university took multiple administrative systems, including Workzone and Nimbus, offline as a precaution after activity initially appeared to indicate a new attack. Following further investigation, security teams determined that the events were connected to the original compromise. While the university ruled out a second intrusion, officials said the controlled shutdown remained necessary because of the continuing impact of the original attack. Some services remain disrupted as remediation efforts continue.

The university first disclosed the breach on October 23 after attackers gained access to a test environment. The intrusion was detected on October 20 and subsequently contained. According to the university, attackers obtained personal information relating to roughly 525,000 individuals, including names, national identity numbers, home and work telephone numbers, and personal email addresses. Investigators continue to assess the full scope of the compromise.

University officials stated that there is currently no evidence that operational systems supporting daily teaching and research activities were accessed, and they have not identified any impact on core university functions. Access routes used by the attackers have been blocked while technical teams work to strengthen defenses and prevent further incidents. The breach has been reported to the Danish Data Protection Agency and other relevant authorities.

In a subsequent update, the university disclosed that PIN codes associated with approximately 20,000 staff and student ID cards were also compromised. New PIN codes have since been issued to all affected users. The university said this disclosure was delayed for security reasons until the replacement codes had been distributed. Following a security assessment, physical access restrictions that had been imposed at selected campus locations have now been lifted.

The incident represents one of the largest education-sector data breaches reported in Denmark in recent years and remains under active investigation as authorities work to determine how the attackers gained access and whether any additional data was affected.