University of Copenhagen discloses breach of PII on about 525,000 people

What happened

The University of Copenhagen (UCPH) has disclosed a cyber-attack. According to Infosecurity Magazine, the university says attackers accessed a test environment, and it estimates that around 525,000 people are affected. This advisory relies on a single news report. The university’s own notice was not available to us, and the details have not been independently verified.

Infosecurity Magazine reports the following, based on the university’s statements:

• The university says it detected the attack on October 20 and “subsequently brought under control.” It published its first notice on October 23 and an update on October 25.
• According to the original notice, the database contains “full name, national identity number, work telephone number, home telephone number and personal email address.”
• The October 25 update says physical access PIN codes for staff and students were also compromised. The figure printed in the article appears garbled, so the exact number of codes is not confirmed.
• On October 23, the university restricted physical access to “selected critical locations on campus” while it reset the compromised PIN codes.
• The university says the incident falls within the scope of GDPR. It has reported the incident to the Danish Data Protection Agency.
• The university first said there was “no indication” that systems supporting day-to-day operations were accessed. It later said administrative systems were disrupted, including the document management platform Workzone and the budgeting tool Nimbus. It described this as a “preventive and controlled shutdown” after “a new hacker attack.”

Infosecurity Magazine says no threat actor had publicly claimed responsibility at the time of writing.

Several points are not confirmed:

• who is behind the attack
• how the attackers got into the test environment
• why personal data was held in a test environment
• whether the data has been published or misused
• how the later attack relates to the first one

Am I affected?

Based on the report, you may be affected if your personal data was held by the University of Copenhagen. The report mentions staff and students in connection with the PIN codes (Infosecurity Magazine).

The full list of affected groups is not confirmed. The report does not say whether former staff, students or other contacts are included.

What to do now

1. Watch for phishing and identity fraud attempts. Infosecurity Magazine notes that the exposed data could be used for convincing follow-on phishing and identity fraud (Infosecurity Magazine).
2. Follow the university’s instructions on the PIN code reset and on restricted campus access. The university says it is resetting the compromised codes (Infosecurity Magazine).
3. Expect possible disruption to Workzone, Nimbus and UCPH websites while the university keeps those systems shut down (Infosecurity Magazine).
4. Check official University of Copenhagen channels for updates. A breach claim alone is not a reason to act on links or attachments in unsolicited messages.

Sources

• Infosecurity Magazine: Copenhagen University Breach Compromises Data on Half a Million People