The University of Copenhagen, Denmark's largest and oldest university, disclosed a breach in which personal details of about 525,000 people, current and former students and staff, were stolen. According to the university, the attackers got into a test environment, a system meant for experiments, and from there reached real data.
What was exposed
According to reports in Help Net Security and BleepingComputer, the attackers obtained names, Danish national ID (CPR) numbers, work and home phone numbers and personal email addresses. Home addresses were not included. A later update said about 20,000 staff and students also had PIN codes exposed. Many of those affected were notified through Denmark's digital mail system on October 27.
The investigation continues
The attackers' identity and motive are still unknown. The university shut down several administrative systems and said this was linked to the same breach rather than a second attack. The incident was reported to Denmark's data protection authority, and its final scope is not yet clear.
The lesson: test environments
It is a common mistake in many organizations: test and development environments are less protected than production systems, yet often contain copies of real data. For attackers, they are a convenient back door. Organizations and institutions in Israel that hold ID numbers of hundreds of thousands of people should check exactly this point.
