University of Copenhagen criticized for handling of cyberattack

The University of Copenhagen is facing criticism for its handling of a cyber attack.

The chair of the Student Council believes that the students should have been informed sooner. A cybersecurity expert agrees.

The students at the University of Copenhagen would have liked to have been informed about the hacker attack sooner. (Photo: © Philip Davali, Ritzau Scanpix) 52 minutes ago.

It took three days before the students at the University of Copenhagen were informed about the hacker attack that took place last Tuesday. Not until Friday were the public and the students made aware of the incident.

And that timeframe is completely unacceptable, according to the chair of the Student Council at the University of Copenhagen, Ira Thomas Bro Pold. He says this to TV 2 Kosmopol.

- It is unfortunate that we only find out about it three days after it happened. I feel there is a lack of respect for the students and a lack of involvement.

Read also: University of Copenhagen has been subjected to a cyber attack

----------------------------------------

'They should be quicker to announce'

----------------------------------------

During the attack, the hackers gained access to one of the university's servers that contained a database. This allowed the hackers to access information about approximately 525,000 people.

The information included, among other things, work phone numbers, CPR numbers, private phone numbers, and email addresses. Sofie Freja Christensen is an expert in cybersecurity and information security and can understand the criticism from the Student Council.

- The university could have been quicker to notify those affected, but it also matters to announce something reasonably accurate rather than being in too much of a hurry. The decision about when to announce should be based on a risk assessment, she says.

She explains that the process has likely been that they first focus on containing the incident. Then they isolate the affected systems, and finally report the incident to the Danish Data Protection Agency.

- Once the worst of the fire is put out, they should be quicker to announce, she says, noting that the University of Copenhagen should be able to account for the three-day timeframe.

She emphasizes that the information the hackers gained access to can be used for phishing, and for that reason, the University of Copenhagen should have announced it sooner to those affected.

- The university could advantageously have announced that they were in the process of investigating a breach and that people should therefore be extra vigilant. One thing is to announce publicly, but another is to inform those affected, she says.

The University of Copenhagen has announced that they are in the process of investigating the exact extent of the incident. Ira Thomas Bro Pold hopes that the students will receive more information about the situation.

- We are also adults, and it is our data that has been accessed. I am curious about what happens now, he says to TV 2 Kosmopol.

DR has attempted to contact the University of Copenhagen in connection with the article.

Warning: This article was translated by a Large Language Model, in case of doubt, you can always visit the original source.