University of Copenhagen breach: CPR numbers of 525,000 people stolen

If you have ever studied or worked at the University of Copenhagen, check your Digital Post. The university says hackers took personal data on about 525,000 current and former students and staff, with records going back to 2002, including CPR numbers that the attackers can probably decrypt.^{1, 2}

Reporting checked October 27, 2026.

Too long; didn’t read?

• Exposed: full name, CPR number, private phone and email, campus-card PIN, citizenship, gender, university username and job title, among other details.²
• Home addresses, passports and health insurance cards are not part of the breach.²
• About 20,000 people have been given new campus-card PINs. If you reused your old PIN anywhere, such as for your bank card, change it there now.^{1, 2}
• Expect convincing scam calls and emails. Never approve a MitID request you didn’t start yourself.⁴

What happened

According to the university’s notification letter, the attack began on October 16, 2026 and continued over the following days. The attacker gained access to systems normally reserved for a small group of IT staff, and one of the attacks succeeded, giving access to a database of personal information. University IT staff discovered it on October 20, after noticing that a system was doing things it shouldn’t.²

The university announced the breach on October 23 and reported it to the Danish Data Protection Agency (Datatilsynet).¹ On October 27 it sent letters through Digital Post to the people affected.¹ It says it does not yet know the attackers’ motive or what they plan to do with the data.²

What was taken

The letter lists the following, where the university held them:²

• full name (and, because the data spans many years, sometimes previous names);
• CPR number, stored encrypted, but the university says there is a “strong presumption” that the attacker can decrypt it, because the decryption information was taken too;
• private phone number and private email address;
• the PIN code for your university access card;
• citizenship, nationality and gender;
• university username, university email, work phone, work address or study affiliation, and job title;
• whether you were actively affiliated with the university in January 2026.

The university stresses that private home addresses are not included. People with name protection will still have their name on the list.² The data was last partly updated on January 13, 2026, so details you changed after that are not in it.²

The PIN codes and the “second attack”

On October 25, the university said the PIN codes of about 20,000 people had been compromised and replaced, and that this was part of the same breach, not a new one.¹ On October 26 it shut down some administrative systems as a precaution. It first described activity there as a new attack, but corrected this on October 27: it was activity within the system linked to the original attack. Some systems remain closed to outside access while they are checked.¹

Why a CPR number matters

In Denmark, your CPR number is used almost everywhere, from banks to doctors to tax and public services.³ Unlike a password, you usually can’t change it: the CPR Office only issues a new number in special cases where it has actually been misused.⁵ That makes it a powerful tool for scammers, who can quote it to sound official. The university’s letter warns that the more an attacker knows about you, the more believable phishing attempts become.²

Knowing your CPR number is not enough to log in as you; that requires MitID. MitID warns that fraudsters often pose as your bank or its support team and pressure you to act quickly “to stop misuse”, which is exactly how they try to get you to approve a login for them.⁴

What you can do

• Read your letter in Digital Post, or the university’s public notification if you no longer have a Digital Post connection to it.^{1, 2}
• Change reused PINs. If you ever chose your own campus-card PIN and use the same code elsewhere, for example on a bank card, change it there immediately, as the university recommends.²
• Treat your CPR number as no proof of anything. If a caller or email “confirms” your CPR number, that tells you nothing about who they are. Hang up and call the organisation back on a number you find yourself.
• Never share MitID codes or approve a request you didn’t start, and contact MitID Support straight away if you think someone has misused yours.⁴
• Consider name and address protection if you are worried about being tracked down. It stops your name and address from being passed on from the CPR register to private companies, lasts a year at a time, and has exceptions for public authorities.⁶

Sources

1. University of Copenhagen, October 23-27, 2026: Operational disruptions at UCPH (updates)
2. University of Copenhagen, October 27, 2026: Notification of a personal data breach (PDF, Danish and English)
3. Life in Denmark: When you arrive
4. MitID: Phishing and fraud with MitID
5. CPR Office: Identity misuse (in Danish)
6. Life in Denmark: Protection of name and address