The recent cybersecurity incident at the University of Copenhagen highlights an often-overlooked security risk: sensitive information stored in development and testing environments.

Hackers gained unauthorised access to a test environment containing personal information belonging to approximately 525,000 individuals, including names, national identification numbers, telephone numbers and email addresses. The university also confirmed that access PINs associated with approximately 20,000 staff and students were compromised, requiring changes to access credentials and temporary restrictions at certain campus locations.

What makes this incident particularly concerning is that the attackers did not need to compromise the university's production systems. According to the university, there is currently no indication that systems supporting daily operations were accessed or disrupted. Yet sensitive personal information was still exposed.

This raises an important question: Why should a test environment contain real personal information, and if it does, shouldn't it receive the same level of protection as production?

Organisations frequently replicate production databases into development, testing and staging environments to simplify application development and troubleshooting. However, these environments may have weaker access controls, broader developer permissions, less comprehensive monitoring and fewer restrictions on data transfers.

When real customer, employee or student information is copied into such environments without appropriate masking or anonymisation, the security risks remain just as serious as in production.

This is where Contextual Data Loss Prevention becomes particularly important. Organisations need visibility into what sensitive information is being accessed, who is accessing it, where it is being transferred and whether that activity is authorised. Data protection policies should extend across production, development, testing and backup environments rather than focusing exclusively on live applications.

The exposure of approximately 20,000 access PINs also demonstrates how a cybersecurity incident can create physical security concerns. Digital information is increasingly connected to building access, identity management and other operational systems. A data breach can therefore have consequences beyond the immediate IT environment.

At GajShield, we believe effective cybersecurity requires a combination of network protection, application security, identity-aware access controls and Contextual Data Loss Prevention. Equally important are data minimisation, masking sensitive information in test databases and enforcing consistent security policies across all environments.

The larger lesson is simple: Sensitive data does not become less sensitive simply because it is stored in a test environment.

Organisations must protect information based on its sensitivity, not merely on the environment in which it resides.

Because attackers do not distinguish between production and testing environments. They look for the easiest path to valuable information.

The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]

Source: University of Copenhagen data breach exposes data of 525,000 people via Bleeping Computer — published 26 Oct 2026.