The University of Copenhagen recently disclosed a significant data breach that compromised the personal information of approximately 525,000 individuals. The breach was detected on October 20 and traced back to a test environment where hackers accessed sensitive data, including full names, national identity numbers, phone numbers, and personal email addresses. Initially, the university stated that operational systems were unaffected, but it later revealed disruptions in several administrative platforms, such as Workzone and Nimbus, due to a subsequent attack. The breach also involved the exposure of physical access PIN codes for around 20,000 staff and students, prompting the university to restrict access to certain campus locations and reset the affected codes. The incident has been reported to the Danish Data Protection Agency as it falls under the scope of GDPR regulations. Universities have become frequent targets for cybercriminals seeking valuable personally identifiable information and for nation-state actors interested in research and intellectual property. A recent study highlighted an 8% rise in ransomware attacks on universities in the first half of the year. The breach at the University of Copenhagen is one of the most significant incidents in this sector in 2023, posing a risk of phishing attacks and identity fraud. No group has yet claimed responsibility for the attack.