Cyberattack on University of Copenhagen exposes data of 525,000 people
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data belonging to some 525,000 people.
On Monday, the university took Workzone, Nimbus and other administrative systems offline in what it called “a preventive and controlled shutdown of the administrative systems in question,” warning that users might have trouble reaching its websites. At the time, UCPH said it had been hit by a new attack.
“Initially, the assessment yesterday was that an entirely new cyberattack had taken place. However, later in the evening it was determined that this was not a new attack, but rather activity within the system that initially appeared to indicate a new attack,” the university said in an update on Tuesday.
“This revised assessment of the incident does not, however, reduce the necessity of the preventive and controlled shutdown initiated by the University of Copenhagen, which remains linked to the original cyberattack,” the university said, adding that some of its systems continue to experience disruptions as a result.
Half a million people’s data exposed
UCPH first disclosed the breach on 23 October, confirming that attackers had broken into one of its test environments. The intrusion was detected on 20 October and brought under control.
In its statement, the university said the attackers obtained data on about 525,000 individuals, including their names, national identity numbers, work and home phone numbers and personal email addresses. UCPH added that it was analysing the precise extent of the breach.
It insisted there was no indication the attackers reached systems that support day-to-day operations, and no evidence that its activities had been affected. Access has been blocked, UCPH said, and staff are working to establish the scope of the incident and prevent similar or further attacks.
Believing the incident falls within the scope of the GDPR, UCPH has reported it to the Danish Data Protection Agency and is keeping other relevant authorities closely informed.
New PIN codes for 20,000 ID cards
In an update on 25 October, the university disclosed that the attack had compromised the PIN codes for ID cards belonging to about 20,000 staff members and students, all of whom have since been issued new codes.
“This is not a new data breach or a new cyberattack in relation to what was communicated on 23 October. For security reasons, UCPH simply chose not to communicate about the compromised ID cards until the PIN codes had been changed,” the university noted.
Following a security assessment, UCPH restricted physical access to selected locations on campus on the evening of 23 October. With the new PIN codes in place, those locations have reopened.
