University of Copenhagen discloses breach exposing personal data on more than 525,000 individuals
Stolen information included names, national ID numbers, contact details, and some campus access PINs
University contained the incident, reported it to regulators, and warned users about phishing risks
The University of Copenhagen in Denmark has confirmed suffering a cyberattack and losing sensitive data on more than half a million people. In a notification published on the organization’s website, it was said that unnamed attackers gained access to one of its test environments, and from there, they pulled full names, national identity numbers (CPR), phone numbers, and email addresses on some 525,000 people. A subsequent update to the announcement added another 20,000 staff and students, whose PIN codes were apparently exposed. Phishing risks
The university responded by restricting physical access to critical locations on campus, and then redistributing new access codes. After that, the locations were gradually reopened. In the meantime, the university’s IT team contained the attack and prevented further incursions and said there was no evidence of any other compromise or disruptions to other systems. The incident was then reported to the Danish Data Protection Agency, and since it falls under the jurisdiction of the General Data Protection Regulation (GDPR), the university was now investigating its next steps. Universities and other educational institutions hold the kind of information cybercriminals find rather valuable. Contact information, paired with private information not many people know, is the kind of data threat actors can use to create tailored and personalized phishing emails. These emails can then trick the victims into downloading infostealer malware , or granting access to systems where a ransomware deployment could be devastating. For example, cybercriminals were seen mailing students saying their email address was due for decommission because it wasn’t used in a little while…