A cyberattack at Aarhus University in Denmark targeted the passwords of approximately 1,700 current and former students and employees, but the attempts were unsuccessful, the university has said. An intruder gained access to one of its servers before IT staff discovered the attack on Monday, 19 October.
In a statement published on 21 October, the university said its IT department had shut down the hacker’s access and contained the incident. There is currently no indication that confidential or sensitive information was leaked, although the investigation is continuing.
How Aarhus University responded to the cyberattack
A review of system logs showed that the attacker had tried to access and change passwords for around 1,700 user accounts. The university said neither attempt succeeded.
IT specialists are working with external experts to establish the full extent of the unauthorised access and identify measures to prevent further incidents. Students and staff can continue their normal activities, but have been advised to watch for phishing attempts and contact IT support if they notice unusual online activity.
The incident has been reported to the Danish Resilience Agency (Styrelsen for Samfundssikkerhed). According to DR, citing the Ritzau news agency, Minister for Resilience and Preparedness Lisbeth Bech-Nielsen, from the Socialist People’s Party, said the agency was in contact with Aarhus University and had already briefed other higher education institutions on cybersecurity.
The university also said the incident was not connected to the recently disclosed security vulnerability affecting the PHP programming language, according to DR.
Another Danish university targeted after the DTU breach
The attack comes after a serious breach at the Technical University of Denmark (DTU), which NordiskPost reported had gone undetected for five days in September. In that case, hackers gained extensive access to the university’s identity management system and downloaded a large amount of data.
DTU warned on 2 October that personal information relating to up to 200,000 users could have been affected, although the precise number of people involved remains unknown. The information potentially exposed included Danish civil registration numbers, known as CPR numbers.
Days later, Danish authorities reported another breach involving the national CPR register, with unauthorised access to personal information associated with around 8.8 million records.
There is no established connection between these incidents. Unlike the DTU breach, Aarhus University has not identified a leak of sensitive data, and investigators are still assessing what the attacker managed to access.
