University of Copenhagen draws criticism over cyberattack notice

The University of Copenhagen is facing criticism for waiting three days to inform students about a cyberattack, DR reports. The attack took place on Tuesday, but students and the public were not notified until Friday.

Ira Thomas Bro Pold, chair of the university’s Student Council, told TV 2 Kosmopol that students should have been informed sooner. He said the delay showed too little respect for students and did not involve them enough.

Hackers accessed a university server containing a database with information on about 525,000 people. The data included work and personal phone numbers, Danish civil registration numbers and email addresses.

Cybersecurity and information security expert Sofie Freja Christensen said the university could have notified those affected sooner, while stressing that it was important to communicate accurate information. She said the timing should be based on a risk assessment and that the university would likely first have focused on containing the breach, isolating affected systems and reporting the incident to the Danish Data Protection Agency.

Christensen said the stolen information could be used for phishing and that the university could have warned people while it investigated the breach. The university has said it is still assessing the incident’s precise scope. Pold said he hoped students would receive more information, noting that their data had been accessed.