Cyber-Attack on University of Copenhagen Affects Over Half a Million Individuals
A significant cyber-attack targeting the University of Copenhagen (UCPH) has compromised sensitive personally identifiable information (PII) belonging to more than half a million individuals. The university disclosed this alarming incident to the public on October 23, and further updates revealed that around 20,000 physical access PIN codes belonging to staff and students were also breached.
In total, data concerning approximately 525,000 people was compromised during the attack, which occurred when hackers successfully accessed a test environment at the university. The university revealed that the breach was detected on October 20, adding that the situation was “subsequently brought under control.” However, it took the administration three additional days to inform the public about the incident.
The initial report outlined the nature of the compromised data, which includes essential details such as full names, national identity numbers, work telephone numbers, home telephone numbers, and personal email addresses. The university acknowledged that this incident falls within the purview of the General Data Protection Regulation (GDPR) and that they are addressing the situation in compliance with applicable regulations. Furthermore, the breach has been reported to the Danish Data Protection Agency, alongside other relevant authorities, to ensure proper oversight.
Initially, the university indicated that there was “no indication” that the attackers had accessed systems essential for day-to-day operations or that the university’s “activities or operations” had been affected. However, it later emerged that several administrative systems were experiencing disruptions, including their document management platform Workzone and budgeting application tool Nimbus.
In light of the ongoing security concerns, UCPH justified the “preventive and controlled shutdown” of the affected administrative systems after they learned of a renewed hacker attempt the following Monday. The university also mentioned that access to its websites may be challenged during this period of heightened security measures.
To enhance security and protect its community further, the university imposed restrictions on physical access to specific critical areas on campus while resetting the compromised PIN codes. This decision reflects a broader trend among higher education institutions, which have long been popular targets for cybercriminals—entities that often focus on stealing monetizable PII—alongside nation-state actors who aim for sensitive research and intellectual property.
A recent study by Comparitech, published in July, noted an 8% increase in ransomware attacks on universities between January and June, a rise attributed mainly to the notorious “Gentlemen” hacking group. The characteristics of universities—an extensive, decentralized structure, relatively open networks, and a high tolerance for service interruptions—render them attractive targets for these cyber threats.
Statistics from the UK government, published on April 30, revealed that nearly every higher education institution (98%) identified a breach or attack within the previous year. Among the most notable incidents recorded in 2023 was an attack by ShinyHunters on the Canvas Learning Management System, which impacted around 275 million records from over 8,000 educational institutions.
Nonetheless, the breach at the University of Copenhagen stands out as one of the most severe incidents in the sector this year, marked by the substantial number of victims and the sensitivity of the compromised data. Such PII could potentially be exploited to conduct convincing follow-on phishing scams and identity theft attempts.
As of the time of writing, no individual or group had publicly claimed responsibility for the breach at Copenhagen University, raising concerns about potential follow-up attacks and the overall security of academic institutions moving forward. Stakeholders are on high alert, urging universities to enhance their cybersecurity measures to prevent such breaches in the future.