University of Copenhagen Hack: What Was Exposed and What to Do

In short: The University of Copenhagen confirmed in a statement that hackers accessed a test environment holding data on roughly 525,000 people, including full names, national identity (CPR) numbers, phone numbers and personal email addresses, according to KU's own statement. Access has been blocked and the breach has been reported to the Danish Data Protection Agency. KU says there is no sign the university's day-to-day operations were affected, and it has not yet said who did it or exactly whose data was taken.

A cyber attack on the University of Copenhagen (KU) has put the national ID numbers of hundreds of thousands of people at risk, following two other major Danish data breaches this month. Anyone who has ever studied, worked at, or partnered with KU should assume their details could be in the exposed database and follow the steps below.

What should I do if I studied or worked at Copenhagen University?

Do this regardless of whether you've received a notification yet:

1. Register a credit warning (kreditadvarsel) through self-service on borger.dk, or at a local Citizen Service office if you need help. A credit warning is a marking on your CPR number that "warns against loans and credit being granted in your name," per Life in Denmark's guide.
2. Treat any call, text or email that already knows your CPR number, phone number, or your KU affiliation as suspicious, not reassuring — knowing those details no longer proves someone is legitimate, as explained in our CPR breach guide.
3. Never share MitID codes, one-time passcodes, or passwords with anyone who contacts you, even if they cite your CPR number to sound official.
4. Watch your bank accounts, mail and credit reports for loans, subscriptions, or accounts you did not open.
5. If you need a loan or credit yourself, you can remove the credit warning beforehand and "always add the credit warning again afterwards," according to borger.dk.
6. Be especially alert to phishing emails using your real name or employer: regulators generally advise people hit by a breach to watch for "phishing emails or fraudulent activity on their accounts," per the UK Information Commissioner's Office.
7. You must be at least 15 years old to add or remove a credit warning yourself; younger students should get a parent or guardian's help.
8. For general post-breach hygiene beyond these steps, see our broader data breach checklist.

If you've already clicked a suspicious link and entered personal or payment details, don't wait to see what happens: contact your bank immediately, consider blocking your card, and change your passwords right away, following the same advice Danish authorities gave after the Central Person Register breach, according to Faxe Kommune's guidance. That guidance also points residents to the Cyberhotline for Digital Sikkerhed for help.

What personal data was exposed in the University of Copenhagen hack?

KU says the hackers accessed "information on approximately 525,000 individuals," including full name, national identity number (CPR), work telephone number, home telephone number and personal email address, according to the university's statement. A CPR number is Denmark's national identity number, used for everything from healthcare to banking — the Danish equivalent of a US Social Security number, which is why its exposure matters more than a leaked email address alone.

Who might be affected by the KU data breach?

KU has not published a breakdown of which 525,000 people are in the exposed database. It says only that it is still working to establish the full extent of the incident, according to KU's announcement. Current and former students, staff, researchers and external partners are therefore all left guessing — until KU names the categories involved, assume you may be among them and take the steps above.

Which systems did the hackers get into?

KU says the attack hit "one of the university's test environments," not systems that run daily operations. The university states there is "no indication that the hackers gained access to systems supporting day-to-day operations," and no evidence that university activities were affected, a point confirmed in a separate republication by Mirage News. The attack was detected on the Tuesday before the announcement and brought under control before KU's public announcement, according to KU's statement. Access has since been blocked while the university works "intensively to establish the full extent of the incident and to prevent similar or further attacks from taking place."

A test environment sitting outside production systems is why KU can say operations weren't disrupted — but it still held real personal data on hundreds of thousands of people, which is the part that matters to anyone whose details were in it.

Who is responsible for the attack, and what happens next?

KU has not named or speculated about who carried out the attack. The university says it estimates the incident falls within the scope of GDPR and that "the incident has been reported to the Danish Data Protection Agency," according to KU's own statement. Under GDPR-style breach rules, organisations must notify their supervisory authority "within 72 hours of becoming aware of the breach, where feasible," and can give details in phases while an investigation continues, according to the UK Information Commissioner's Office. KU has said "further information will be provided once a clearer picture of the incident has emerged" and that it "has no further comments on the matter at this stage," per the university's statement.

Is this part of a bigger pattern in Denmark?

The KU breach follows two other major incidents disclosed in October 2026. The Technical University of Denmark (DTU) reported a breach potentially affecting 200,000 current and former users, including employees, students, guests and external partners, with exposed data that "may include full names and CPR numbers," per The Copenhagen Post. DTU also warned that leaked personal details "can also make phishing attempts and other abuse more credible," a warning that applies equally to anyone named in the KU database. Earlier in the month, Denmark's Central Person Register confirmed a breach exposing names, addresses and CPR numbers for about 8.8 million people, as detailed in our earlier coverage. Three confirmed breaches touching CPR numbers within one month means the advice above is worth following even if you're not sure which database your information was in.

If your details were exposed in the earlier, far larger CPR register breach, see our dedicated guide on that incident for the full list of who was affected and what to do next.

Updated 26 October 2026: Added guidance on what to do if you've already clicked a phishing link or shared details after the breach, plus a closing link to the related Danish CPR register breach guide.