The University of Copenhagen breach started in staging: hackers reached one of the university's test environments, which held personal data on 525,000 people, including Danish CPR numbers. A later update added 20,000 staff and students whose campus PIN codes were exposed. If your UAT holds real customer data, GDPR, NIS2 and DORA treat it exactly like production.
Key takeaways
- Attackers reached a University of Copenhagen non-production system holding names, CPR numbers, phone numbers and emails of 525,000 people.
- About 20,000 staff and students had campus PIN codes leaked, prompting access restrictions.
- The breach was reported under GDPR; staging with real data carries the same duties as production.
What has the University of Copenhagen said about the breach?
Denmark’s oldest university, founded in 1479, detected the intrusion on a Tuesday, disclosed it that Friday and added the PIN exposures in a later update. It has not published calendar dates and says the attack is contained.
“Currently, there is no indication that hackers accessed systems supporting daily operations or disrupted university activities,” the university said. That speaks to operations, not to the data. No threat actor, vulnerability, malware or entry point has been named, and nobody has said whether data was copied, published or held for ransom.
Which data may have been exposed, and why did campus doors close?
Full names, CPR numbers, phone numbers and email addresses may have been exposed. A CPR number is a lifelong national identifier that cannot be rotated like a password, the same data class that leaked in Denmark’s earlier CPR exposure via a single supplier account.
About 20,000 staff and students had PIN access codes exposed. The university restricted access to some critical campus locations as a precaution and is reopening them as it issues new codes. If codes are reused across people, door logs prove only that a code was used, not who used it.
The 525,000 figure is about eleven times the university’s headcount of roughly 47,500 students and staff, so it likely includes former students, staff or outsiders.
Does a test-environment breach still count under GDPR and NIS2?
Yes. The university reported the incident to the Danish Data Protection Agency and says it falls within GDPR, which has no exception for non-production: any system holding data on identifiable people carries the same security and notification duties, pseudonymized data included.
Article 33 requires notifying the regulator without undue delay, within 72 hours where feasible. Article 34 requires telling affected people directly when risk is high, which here could mean all 525,000; reporting does not show whether that has happened.
NIS2 risk management covers an entity’s network and information systems as a whole, and ISO 27001:2022 control 8.33 is dedicated to protecting test information. CySEC and DORA examiners are unlikely to accept “it was only UAT.”
What should Cyprus boards decide about real data in staging?
Management should decide, in writing, whether real customer data may sit in non-production at all, and pay for masking or synthetic data if the answer is no. EMIs, iGaming operators and brokers face the same exposure when KYC files, passport numbers and app PINs are copied into UAT.
Practitioner’s note: in our engagements, staging is often the easiest foothold: a forgotten subdomain, default admin credentials, a database restored from an old production backup, no alerting. Clients usually scope NIS2 penetration testing to production because the auditor named it.
- Inventory every non-production copy of personal data, with owner and retention reason.
- Mask or synthesize identity fields before data leaves production.
- Put staging behind the same SSO, MFA and logging as production.
- If access codes leak, revoke and reissue reused codes and review door-controller logs.
- Warn service desk teams that callers with real names and phone numbers sound convincing, and test verification habits with a phishing simulation.
FAQ
How many people are affected by the University of Copenhagen breach?
Data on 525,000 people may have been exposed, plus about 20,000 staff and students whose PIN codes leaked. Any overlap is unconfirmed.
Were University of Copenhagen production systems hacked?
The university says there is no indication so far; the confirmed access was to one test environment.
Is there a known ransom demand or data dump?
No. No threat actor has been named, and the university has not said whether data was copied or published.
If your UAT or staging systems hold real customer data, they belong in your test scope. Our web application penetration testing covers every environment, not only production.