Information regarding the personal data breach

During the recent cyber attack on the University of Copenhagen, the attacker managed to obtain personal data relating to a large number of current and former members of the university community. Here you can read about the information affected and the precautions those affected should take – and find out who to contact if you have any questions.

The attack was detected by UCPH IT on October 20th 2026, when staff noticed suspicious activity in an IT system. Subsequent investigations have revealed that the attacker gained access to a database containing personal data.

What information is affected?

The compromised information varies from person to person, but may include name, contact details, UCPH username, UCPH email address, citizenship, nationality, gender and information regarding affiliation with the university. In addition, the breach includes encrypted CPR numbers as well as PIN codes for UCPH access cards. The University assesses that there is a significant risk that the encrypted CPR numbers could be decrypted, as the information required for decryption has also been compromised.

Private residential addresses are not included in the compromised dataset. This also applies if you have shared sensitive personal data – such as health information – with the University of Copenhagen.

No clarity on the motive

It is not yet known who is behind the attack or what its purpose is. The University of Copenhagen is continuing to work to establish the sequence of events and the extent of the compromised data.

As part of its response to the incident, the University has blocked access to the affected systems and launched a comprehensive technical investigation. The matter has also been reported to both the police and the Danish Data Protection Agency.

Risk of phishing and identity theft

The University assesses that the stolen information may be used for more targeted phishing attempts, fraudulent communications and attempts at identity theft. Those affected are therefore urged to be particularly vigilant regarding unexpected calls, text messages and emails in which the sender attempts to obtain passwords, MitID details or other confidential information.

Individuals who have reused the PIN for their UCPH access card elsewhere are also advised to change these codes as soon as possible.

Those affected are being notified directly wherever possible

The University of Copenhagen is in the process of notifying those deemed to have been affected by the breach. A large proportion of those affected – whose CPR numbers were included in the leak – were notified via Digital Post on 27 October. Those for whom we have email details will receive a direct email about the breach later today, 28 October. Those for whom the University of Copenhagen does not have sufficient contact details can view the letter here.

If you are among those affected and have any questions, please write to GDPRbreach@ku.dk

The University is regularly publishing updates on the matter at www.ku.dk/en