Copenhagen University has been hacked.
The data of 525,000 people held on the university’s servers has been stolen. It includes names, CPR numbers (Danish civil registration numbers), phone numbers, and email addresses.
The hack was discovered on Tuesday and made public in a press release on Friday.
Aarhus University first
Aarhus University reported earlier in the week that it had experienced a hacking attempt. It discovered the attempt on Monday and went public with the information on Thursday.
In that attack, hackers tried to gain access to the passwords of 1,700 students and employees. However, the attempt was discovered and stopped.
Aarhus University confirmed that the attack was not related to the ongoing vulnerabilities in the PHP programming language.
Copenhagen University next
The hack of Copenhagen University was much more significant and was not stopped in time to prevent the hackers from walking away with large amounts of data.
The hackers gained access via the university’s test environments, and that access has since been shut down.
In its press release, the university writes: “Access has been closed, and the university is working intensively to uncover the full extent of the incident and to prevent similar or further attacks from taking place.”
It notes that the data leak has been reported to the Danish Data Protection Agency in accordance with GDPR rules.
It adds: “Further information will be provided once there is a clearer picture of the incident. The University of Copenhagen has no additional comments on the matter at this time.”
Broader security concerns
This incident comes after weeks of serious data security concerns across Denmark.
Earlier this month, almost 9 million CPR numbers were leaked in a massive hack of the Danish CPR registry.
The department store Magasin also had its customer rewards programme hacked. The breach was discovered on 18 October and disclosed on Wednesday 21 October.
This week, many websites across Denmark and the world were also shut down due to vulnerabilities in a common programming language.
On Thursday, the Minister of Resilience and Preparedness, Lisbeth Bech-Nielsen of the Green Left (Socialistisk Folkeparti), announced that the government was working on rebuilding Danish cyber security capabilities.
Commenting on this specific incident, Bech-Nielsen told Ritzau: “The Agency for Societal Security generally assesses that universities in Denmark are exposed to the threat of cyberattacks.
“This is partly because they are leading in a number of research areas. I know that the universities are actively working to counter this threat.”
