University of Copenhagen Breach Exposes 525,000 Individuals as Tromsø Fights a Targeted Attack: Nordic Universities Under Pressure

Scandinavia's universities had a bad fortnight. On the evening of Friday 23 October the University of Copenhagen told staff, students and a very large number of former students that hackers had reached one of its test environments and accessed personal data on about 525,000 people, including Danish national identity numbers. By the following Friday, UiT The Arctic University of Norway in Tromsø was telling its community to expect a weekend of instability as it fought what its administrative director called a targeted attack by "an actor with large resources."

The two incidents are not linked by any evidence, and neither university has named an attacker. But they share a sector, a season and a set of lessons that apply to every UK university, college and research institute: test environments hold real data, personal records are kept for decades, and a well-resourced adversary will pick its moment.

What Happened

Copenhagen: a test environment with twenty years of real data

According to the university's running statement, the intrusion was detected on Tuesday 20 October and brought under control. The university said then that there was no sign that the systems supporting day-to-day operations had been reached. What had been reached was a test environment, and in it the attacker found and accessed information on roughly 525,000 individuals: full name, national identity number (the Danish CPR number), work and home telephone numbers and personal email address. On 28 October the university corrected its earlier description to say the data dates back to 2002, which is why the affected population is several times the size of the current student body and staff.

The disclosure came on the evening of Friday 23 October, three days after containment, and was reported to the Danish Data Protection Agency under the GDPR. The same evening, following a security assessment, the university restricted physical access to selected critical locations on campus. The reason emerged two days later: the attack had also compromised the ID card PIN codes of around 20,000 current members of staff and students. The university waited until new PINs had been issued before announcing it, then reopened the restricted buildings.

Monday 26 October brought what the university first described as a new hacker attack and a "preventive and controlled shutdown" of administrative systems, including the WorkZone document management platform and the Nimbus budgeting tool, with incoming network traffic blocked so that most services could only be reached on campus or over the staff VPN. On 27 October the university revised that assessment: the activity that looked like a fresh attack was internal system activity, and the shutdown, while still considered necessary, was linked to the original intrusion. Over the following days it restored the Absalon learning platform and Digital Exam, confirmed that the following week's exams would go ahead, and extended the nomination deadline for its internal elections to 4 November because the election system was only reachable on campus. Letters went to affected people via Denmark's Digital Post on 28 October; where the university held only a name, it published the letter online instead.

Tromsø: a targeted attack during term time

UiT's notice, published at 13:50 on Friday 30 October, says the university is handling "an ongoing targeted attack" on its data systems, has activated its emergency preparedness and is using its own staff and external specialists to limit and stop it. Jørgen Fossland, the university's administrative director, told Khrono that problems began on the morning of Thursday 29 October, that the attack "appears to be specifically aimed at us" rather than at other institutions, and that as of Friday afternoon "we do not currently have a situation involving theft of data." He said the university did not know who was behind it, and told kode24 the attacker was "an actor with large resources", adding that there are quite a few such actors now and that motives vary widely according to the threat assessments of Norway's security services.

The visible impact was concentrated on a few services and small servers, some of them deliberately closed as a precaution. The university library's Munin portal for submitting assignments and theses and its Ubdigital archive and publishing platform were affected, as were several language services including dictionaries, machine translation and language-learning tools. An internal memo reported by Nordlys told staff the situation was uncertain and that preparedness would stay high for days. Students and staff were asked to be cautious with unexpected emails, links and login requests and to follow the university's service status page.

Khrono's reporting places the attack in a sequence. Norway's higher education sector has already seen a data breach affecting the Canvas learning platform in May, distributed denial-of-service attacks on several services in late August, and public bodies taking websites down in October after a serious programming language vulnerability was disclosed, with OsloMet temporarily removing its sites on the advice of Sikt, the sector's shared IT provider. Cybergen's threat intelligence team has been tracking these Norwegian and Nordic developments closely; Norway raised its national cyber risk level to High for the first time on 28 October, the day before UiT's problems began.

Who Is Affected

In Copenhagen the affected group is anyone with a record in the university's systems since 2002: current and former students, applicants, staff and many people who have long since moved on. For them, the risk is identity fraud and targeted phishing. A CPR number combined with a name, phone number and personal email is enough to open a convincing conversation with a bank, an employer or the person themselves. The 20,000 ID card holders faced a more immediate problem, which is why physical access was restricted until their PINs were replaced.

In Tromsø the impact so far is operational: disrupted library submission and archive services, unstable language tools and a community warned to be careful with anything asking them to log in. The university's statement that no data theft had been identified is a snapshot, not a conclusion, and it will be updated as the investigation continues.

For UK institutions the relevance is direct. Universities hold decades of student and staff records, operate sprawling estates of test, research and departmental systems, run on shared national infrastructure, and have term-time pressure points when a shutdown hurts most. Infosecurity Magazine notes that government figures published on 30 April put the proportion of UK higher education institutions reporting a breach or attack in the previous twelve months at 98 percent, and that the ShinyHunters attack on the Canvas platform earlier this year affected around 275 million records across more than 8,000 institutions worldwide. By victim count and data sensitivity, Copenhagen ranks among the worst single higher education incidents of the year.

Why It Matters

The Copenhagen breach is a story about where data lives rather than how an attacker got in. A test environment is, by definition, not production, and it is rarely protected or monitored as if it were. Yet the quickest way to make a test realistic is to copy real records into it, and once copied those records are rarely deleted. The university's correction that the data dates back to 2002 suggests precisely that: a historical export sitting somewhere that was never treated as a crown jewel. Every organisation with a development team has a version of this problem, and the GDPR's storage limitation principle exists for exactly this reason.

The incident also shows how a data breach becomes a physical security problem. Compromised ID card PINs meant the university had to restrict access to buildings until 20,000 codes were reissued. Any organisation whose access control system shares a database with its identity data should assume the two will fall together.

Tromsø raises a different point: a targeted attack on a specific institution by a well-resourced actor, during term, in a country whose national cyber risk level had just been raised. Whether the motive turns out to be espionage, disruption or extortion, the defence looks the same, which is why UiT's response, declaring an emergency, bringing in external help and communicating early, is the right template even before anyone knows what was taken.

What To Do Now

Find the copies. Ask every team that runs a test, development, research or reporting system whether it holds real personal data, how old that data is and who can reach the system. Then verify with discovery tooling, because the honest answer is often "we are not sure." Where real data is needed for testing, mask or synthesise it; where it is not, delete it and document the deletion.

Treat non-production like production for anything holding personal data. That means the same access controls, logging, patching and monitoring. If that is unaffordable, the data should not be there. Copenhagen's breach would have been a minor incident if the test environment had held test data.

Apply retention limits. Twenty-four years of student and staff records is a liability rather than an asset. Agree what must be kept for how long, archive it offline with restricted access, and remove it from systems that face the network.

Separate physical access from identity data, or plan for both to fall. If your access control PINs or card data sit alongside HR or student records, assume a breach of one compromises the other and rehearse the reissue process. Copenhagen managed it in two days; it is worth knowing how long it would take you.

Prepare for the follow-on phishing. Stolen records are used quickly against the people in them and against the institution's own staff. Warn your community in plain language, as both universities did, brief service desks on what a convincing impersonation will look like, and make sure multi-factor authentication is enforced on every system a stolen password would otherwise open.

Know who you will call. UiT's emergency footing and use of external specialists within a day is the model. Have your incident response arrangements, sector contacts and regulator notification routes agreed before term starts, not during an attack.

How Cybergen Can Help

Cybergen's CREST penetration testing and cyber security review services find the test environments, historical exports and forgotten servers where live personal data accumulates, and our data loss prevention consultancy helps you mask, minimise and retire it. Our 24/7/365 managed detection and response watches non-production systems as closely as production, and our incident response service and security awareness and phishing simulations prepare your community for the targeted attacks and follow-on phishing that universities in Denmark and Norway are dealing with now.

Frequently Asked Questions