A cyber-attack on a leading Danish university has resulted in the compromise of sensitive personally identifiable information (PII) on over half a million individuals.
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
In total, it said around 525,000 people were affected by the data breach, which occurred when hackers were able to access a test environment.
According to the university, the attack was detected on October 20 and “subsequently brought under control,” although it took three more days to issue a public notification.
Read more on university cyber-attacks: Ransomware Attacks Targeting Universities on the Rise
“The database contains personally identifiable information such as full name, national identity number, work telephone number, home telephone number and personal email address,” the original notice explained.
“The university estimates that the incident falls within the scope of the General Data Protection Regulation (GDPR), and the matter is being handled in accordance with applicable regulations. The incident has been reported to the Danish Data Protection Agency, and other relevant authorities are being kept closely informed.”
The university originally claimed that “there is no indication” that its attackers accessed systems “supporting day-to-day operations,” or that its “activities or operations” had been impacted.
However, it later admitted that several administrative systems including document management platform Workzone and application budgeting tool Nimbus were suffering disruption.
“This is a preventive and controlled shutdown of the administrative systems in question, as UCPH was exposed to a new hacker attack earlier Monday. There may be challenges accessing UCPH's websites,” it added.
On October 23, the university also restricted physical access to “selected critical locations on campus” while it reset the compromised PIN codes.
Universities Under Attack
Higher education institutions have long been a popular target for both cybercriminals and nation state actors – the former focused on stealing monetizable PII from staff and students and the latter on sensitive research and IP.
A Comparitech study from July claimed that the number of ransomware attacks against universities between January and June increased by 8% compared with the previous six months, thanks mainly to The Gentlemen group.
Extensive, decentralized and relatively open networks, a low tolerance for outages, and large user numbers make universities a popular target.
According to the most recent UK government figures published on April 30, almost every higher education institution (98%) identified a breach or attack in the previous 12 months.
The biggest incident in the sector so far this year came when ShinyHunters targeted the Canvas Learning Management System used by many universities to compromise around 275 million records from over 8000 educational institutions.
However, the breach at Copenhagen University ranks as one of the worst single incidents of its kind this year, in terms of the number of victims and the sensitivity of the data, which could be used to craft convincing follow-on phishing attacks and identity fraud attempts.
No threat actor had publicly claimed responsibility for the breach at the time of writing.