The Field Briefing — from the Red Flag Cyber research desk. Two new breach reports since the last issue.

University of Copenhagen breach: hackers accessed data on about 525,000 people, national ID numbers included

What happened: The University of Copenhagen said on October 23, 2026 that hackers gained access to one of its test environments. The attack was detected on Tuesday, October 20, 2026 and access has since been blocked. The university says there is no indication the hackers reached systems supporting its day-to-day operations.

Who is affected: Approximately 525,000 individuals whose information was held in the database — full names, national identity (CPR) numbers, telephone numbers and personal email addresses. No passwords were listed among the information in the database.

The one action that matters: Treat unexpected calls, texts or emails that quote your real CPR number, telephone number or other real details as unproven until you have checked them independently — go to the organisation concerned yourself, through its official site or a number you already trust. If you believe your CPR number has been misused, report it to the police and follow the guidance of the Danish Data Protection Agency.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/university-of-copenhagen

Navigate360 breach: about 8.3 million tip-system records involved, Social Security numbers may be included

What happened: Navigate360, the company behind the P3 tip-management platform used by school safety programs, Crime Stoppers programs and law enforcement agencies, said in a notice dated October 23, 2026 that an unauthorized third party accessed one of its systems and obtained copies of data between November 21, 2025 and March 5, 2026. Washoe County School District, summarising the investigation, says the incident involved approximately 8.3 million data records across the United States and Canada. For Nevada's SafeVoice program, Nevada says approximately 10 percent of tips containing personally identifiable information was compromised.

Who is affected: People whose information was in the copied data — which may include names, addresses, dates of birth and Social Security numbers, telephone numbers and email addresses. SafeVoice tips may also contain student names, family member names, student identification numbers and information related to medical conditions or treatment, included voluntarily by the person reporting.

The one action that matters: If you or your child used a school tip line run on Navigate360's platform, monitor financial and personal accounts and review credit activity. Navigate360's dedicated call center for this incident is 833-966-1754, Monday to Friday, 9 a.m.–9 p.m. Eastern Time. Treat unexpected messages that reference a tip you submitted, or your child's details, as unproven until you have checked them through the school or the official program site yourself.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/navigate360

More reports, guides and the free Spot the Phish checklist: https://red-flag-cyber-site.andrewdpeat.workers.dev

— Red Flag Cyber research desk