University of Copenhagen Test‑Environment Breach Exposes Personal Data of 525,000 Individuals
Hackers accessed a University of Copenhagen test environment, stealing names, CPR numbers, phone and email data for 525,000 people and PIN codes for 20,000 staff and students. The incident underscores the importance of robust access‑control and monitoring to satisfy GDPR and other compliance regimes.
ADTP Breach Watch· October 26, 2026· BleepingComputer
The University of Copenhagen disclosed that attackers breached a test environment and obtained personal data for 525,000 individuals, later adding 20,000 staff and students whose campus‑access PIN codes were also exposed. The compromised fields include full names, national identity numbers (CPR), phone numbers and email addresses. The university detected the intrusion on a Tuesday, blocked the attackers’ access, and reported the incident to the Danish Data Protection Agency under GDPR. No operational systems appear to have been disrupted.
Why it matters for trust and compliance
The incident demonstrates why strong access‑control policies and continuous monitoring of non‑production systems are essential control objectives that map to GDPR and many other frameworks.
Validate that privileged access to test environments is logged and reviewed regularly.
Collect evidence of MFA and least‑privilege enforcement to support GDPR audit readiness.
Enforce least‑privilege and MFA for all test‑environment accounts.
Deploy continuous monitoring and alerting on privileged access activity.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.