INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Copenhagen University Data Compromised Exposing Half a Million Users

| 2026-10-27 11:00 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A cyber-attack on the University of Copenhagen resulted in the compromise of sensitive personally identifiable information (PII) on over half a million individuals, with around 525,000 people affected. The attack occurred when hackers accessed a test environment and targeted data including full name, national identity number, work telephone number, home telephone number, and personal email address. The breach was detected on October 20 but took three days to issue a public notification, with physical access PIN codes for around 20,000 staff and students also compromised. The attack is believed to be the result of hackers exploiting vulnerabilities in administrative systems including document management platform Workzone and application budgeting tool Nimbus, which were subsequently shut down as a precautionary measure.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHuntersThe GentlemenThe Gentlemen
Target & Sectors
Global Scope educationeducation
Incident Timeline
‎April 30
The UK government reported that almost all higher education institutions (98%) identified a breach or attack in the 12 months leading up to April 30.
source_region United Kingdom
According to the most recent UK government figures published on April 30, almost every higher education institution (98%) identified a breach or attack in the previous 12 months.
general_metric 98 %
According to the most recent UK government figures published on April 30, almost every higher education institution (98%) identified a breach or attack in the previous 12 months.
‎October 20
Threat actors used an unspecified vector to target Copenhagen University, compromising data on approximately half a million people.
‎October 23
Threat actors used phishing to target the University of Copenhagen, compromising data on approximately half a million people.
organisation The University of Copenhagen
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
organisation UCPH
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
organisation PIN
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
general_metric 20,0000 staff
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
‎October 25
Threat actors used phishing to target the University of Copenhagen, compromising data on approximately half a million people and physical access PIN codes for around 20,000 staff and students.
organisation The University of Copenhagen
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
organisation UCPH
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
organisation PIN
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
general_metric 20,0000 staff
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
‎2026/10/27
A cyber-attack on Copenhagen University resulted in the compromise of sensitive personally identifiable information (PII) on over half a million individuals.
organisation Comparitech
A Comparitech study from July claimed that the number of ransomware attacks against universities between January and June increased by 8% compared with the previous six months, thanks mainly to The Gentlemen group.
threat_actor The Gentlemen
A Comparitech study from July claimed that the number of ransomware attacks against universities between January and June increased by 8% compared with the previous six months, thanks mainly to The Gentlemen group.
organisation Copenhagen University
However, the breach at Copenhagen University ranks as one of the worst single incidents of its kind this year, in terms of the number of victims and the sensitivity of the data, which could be used to craft convincing follow-on phishing attacks and identity fraud attempts.
organisation Copenhagen University Breach Compromises Data
Copenhagen University Breach Compromises Data on Half a Million People.
organisation PII
A cyber-attack on a leading Danish university has resulted in the compromise of sensitive personally identifiable information (PII) on over half a million individuals.
organisation the General Data Protection Regulation
“The university estimates that the incident falls within the scope of the General Data Protection Regulation (GDPR), and the matter is being handled in accordance with applicable regulations.
organisation the Danish Data Protection Agency
The incident has been reported to the Danish Data Protection Agency, and other relevant authorities are being kept closely informed.”
organisation Nimbus
However, it later admitted that several administrative systems including document management platform Workzone and application budgeting tool Nimbus were suffering disruption.
organisation IP
Universities Under Attack Higher education institutions have long been a popular target for both cybercriminals and nation state actors – the former focused on stealing monetizable PII from staff and students and the latter on sensitive research and IP.
threat_actor ShinyHunters
The biggest incident in the sector so far this year came when ShinyHunters targeted the Canvas Learning Management System used by many universities to compromise around 275 million records from over 8000 educational institutions.
organisation the Canvas Learning Management System
The biggest incident in the sector so far this year came when ShinyHunters targeted the Canvas Learning Management System used by many universities to compromise around 275 million records from over 8000 educational institutions.
data_breach 275 records
The biggest incident in the sector so far this year came when ShinyHunters targeted the Canvas Learning Management System used by many universities to compromise around 275 million records from over 8000 educational institutions.
Tactical Metrics
Metrics
data_breach
275,000,000
Records
The biggest incident in the sector so far this year came when ShinyHunters targeted the Canvas Learning Management System used by many universities to compromise around 275 million records from over 8000 educational institutions.
Intelligence Sources
Infosecurity-Magazine 2026-10-27