Summary
- Attackers gained access to DTU’s identity and access management system, DTUBasen, and downloaded a large volume of data.
- Records relating to around 40,000 current and 160,000 former users may have been affected.
- DTU cannot determine precisely which records were downloaded or how many people were affected.
After attackers compromised university profiles and used them to reach its identity and access management system, Denmark’s Technical University has warned that personal information relating to as many as 200,000 current and former users may have been affected.
A large volume of data was downloaded from DTUBasen, which contains information relating to approximately 40,000 active users and 160,000 former users. DTU cannot determine precisely which records were taken or how many people were affected, so those figures describe the population potentially exposed rather than a confirmed victim total.
Information held for active users can include Danish civil registration numbers, full names, home addresses, profile pictures, work email addresses, job titles, office locations, and other employment information. Since records within the system date back to 2003, the affected population may include current and former employees, students, guests, and external partners.
Although some information is removed after a person leaves DTU, the breach reaches beyond people who currently study or work at the university because DTUBasen continues to retain certain information about former users. That long history enlarges the pool investigators must consider while they establish what the attackers actually downloaded.
DTU’s incident response team has contained the attack and brought in external specialists, while the university has reported the breach to the Danish Data Protection Agency and referred the case to other relevant authorities. Its investigation is continuing alongside those official enquiries.
Identity records extend beyond current users
Central identity systems often retain information across enrolment, employment, access changes, and departure because they support decisions about who a person is and which services they can use. When that layer is compromised, the exposure can therefore reach records accumulated across many years rather than information attached to one application.
In DTU’s case, attackers first compromised university profiles before using them to gain access to DTUBasen, linking the initial account compromise directly to the wider data exposure. The university has not disclosed how those profiles were compromised or identified the people responsible.
With names, contact information, organisational affiliations, and potentially civil registration numbers among the information stored in the system, stolen records could also give criminals material for more convincing fraud or phishing. DTU has advised potentially affected users to be alert to unexpected enquiries and authentication requests while the investigation continues.
The eventual scale will depend on the contents of the downloaded material rather than the total number of records present in DTUBasen. DTU has confirmed access to a system containing information relating to around 200,000 people, but it has not said that every one of those records was taken.
