Copenhagen University Breach Compromises Data on Half a Million People
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
The incident has been reported to the Danish Data Protection Agency, and other relevant authorities are being kept closely informed.” The university originally claimed that “there is no indication” that its attackers accessed systems “supporting day-to-day operations,” or that its “activities or operations” had been impacted.
According to the university, the attack was detected on October 20 and “afterward brought under control,” although it took three more days to issue a public notification.
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
The campaign demonstrates how stolen GitHub tokens can turn legitimate automation features into a credential theft mechanism, while newer platform controls can disrupt some abuse without eliminating the underlying risk from compromised credentials.
In total, it said around 525,000 people were affected by the data breach, which occurred when hackers were able to access a test environment.
However, the breach at Copenhagen University ranks as one of the worst single incidents of its kind this year, in terms of the number of victims and the sensitivity of the data, which could be used to craft convincing follow-on phishing attacks and identity fraud attempts.
In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000), promising in exchange not to leak stolen data.
Wiz identified infostealer logs and earlier supply chain compromises, such as the March compromise of the Trivy security scanner , as sources of the stolen tokens.
According to the most recent UK government figures published on April 30, almost every higher education institution (98%) identified a breach or attack in the previous 12 months.
No threat actor had publicly claimed responsibility for the breach at the time of writing.
What happened
The incident has been reported to the Danish Data Protection Agency, and other relevant authorities are being kept closely informed.” The university originally claimed that “there is no indication” that its attackers accessed systems “supporting day-to-day operations,” or that its “activities or operations” had been impacted.
According to the university, the attack was detected on October 20 and “afterward brought under control,” although it took three more days to issue a public notification.
What changed
The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
The campaign demonstrates how stolen GitHub tokens can turn legitimate automation features into a credential theft mechanism, while newer platform controls can disrupt some abuse without eliminating the underlying risk from compromised credentials.
Who is affected
In total, it said around 525,000 people were affected by the data breach, which occurred when hackers were able to access a test environment.
However, the breach at Copenhagen University ranks as one of the worst single incidents of its kind this year, in terms of the number of victims and the sensitivity of the data, which could be used to craft convincing follow-on phishing attacks and identity fraud attempts.
Why it matters
In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000), promising in exchange not to leak stolen data.
Wiz identified infostealer logs and earlier supply chain compromises, such as the March compromise of the Trivy security scanner , as sources of the stolen tokens.
Attribution
Infosecurity Magazine: The University of Copenhagen (UCPH) first revealed the news on October 23 but added an update on October 25 claiming that physical access PIN codes for around 20,0000 staff and students were also compromised.
BleepingComputer: South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks.
Infosecurity Magazine: In research published October 25, Wiz said it had tracked the campaign, dubbed Gheist, since September 15 and recovered the branches from more than 850 compromised accounts.
What to watch next
Watch for updated vendor guidance and fixed-version details.