Hacked: University of Copenhagen kept 525,000 real identities in a test database

On the evening of Friday, October 23, the University of Copenhagen closed access to several of its premises deemed critical. That same evening, it announced a cyberattack. Hackers had broken into one of its test environments, meaning a system meant for trials rather than day-to-day operations. It held information on about 525,000 people.

According to the university, the intrusion was detected the previous Tuesday, October 20, and then contained. The data involved includes full names, CPR numbers (Denmark's national identification number), work and personal phone numbers, and private email addresses. The incident was reported to Datatilsynet, the Danish data protection authority. Then, on October 26, a new attack led the institution to shut down several administrative systems as a precaution.

Why 525,000 people?

The figure is puzzling. According to BleepingComputer, the university has about 36,800 students and 10,700 employees. The number of people affected therefore far exceeds its current population. The institution has not said which groups they belong to, and says it is still analyzing the exact extent of the leak. It says nothing indicates that the hackers reached the systems used for day-to-day operations. No claim of responsibility has been reported so far: the attacker remains unknown.

Building access codes changed in an emergency

The closure of the premises was explained on October 25. The university then revealed that the PIN codes of about 20,000 access cards held by employees and students had also been compromised. It stressed that this is not a new leak: it waited until the codes had been changed before announcing it. The premises reopened once the new codes were distributed.

A second attack within a week

On October 26 at 5:50 p.m., the university published a new notice. It had been targeted by another attack during the day and had shut down several administrative systems, including Workzone, “in a preventive and controlled manner.” Its websites may also be hard to reach. It does not say whether the two attacks are linked.

“This is the second time in a short period,” Minister for Research, Education and Digital Affairs Christina Egelund told the Ritzau news agency, saying she is taking the situation very seriously, according to TV2 Kosmopol. The Technical University of Denmark (DTU) and Aarhus University have also been targeted in recent weeks. At Aarhus, a hacker tried to change the passwords of about 1,700 users, without success because the intrusion was spotted, DR reports.

Best practices

No spectacular vulnerability has been announced. What we know: the hackers accessed a test environment that held very real data. For those affected, the main risk is phishing: with a name, a phone number and an ID number, a scammer can credibly pose as the university, a bank or a government agency. BleepingComputer advises those affected to be wary of unsolicited messages and to verify any request through another channel.

For organizations, the lesson goes beyond Denmark. A test database should contain fictitious or anonymized data. If that is not possible, it must be protected and monitored like production. Research institutions are regular targets, in France too: Ined, the French public demographic research institute, had to shut down its entire network after an intrusion this month. In Copenhagen, it remains to be seen who these 525,000 records belong to, and whether the second attack allowed the hackers to take more.