Compromised login to DTU's identity system put up to 200,000 people's records at risk
Technical University of Denmark says a login with compromised credentials to its IAM system may have exposed data on up to 200,000 people. The records reach back to 2003, and active users' entries include CPR national ID numbers that DTU warns can be used for identity fraud.
The Watch · Security desk
What happened
- DTU said in its Friday disclosure that it cannot determine precisely what information was downloaded or how many people were affected.
- DTUBasen holds records on nearly 40,000 active users and around 160,000 former users.
- Home addresses, profile pictures and next-of-kin details of former users are deleted automatically after six months, according to DTU.
- DTU is asking people to pass its disclosure to former employees, students, guests and external partners it cannot contact directly.
Why it matters
- What it limits constraint DTU's 200,000 ceiling is the entire DTUBasen population, so until the university learns what was downloaded it has to handle every current and former user as exposed.
- Who's exposed exposure Relatives listed as next of kin have phone numbers in the exposed data but no CPR number on file at DTU, so they depend on the public notice reaching them.
- What it costs cost The cleanup DTU recommends, a credit alert on the CPR number and new passwords on any service sharing the DTU credentials, is work each affected person has to do.
Next story · Security · Oct 6
Suspected ransomware takes down about 500 servers at Osaka Metropolitan UniversityConfirmed2 publishers
Former users are about 80 percent of the people in DTUBasen [16]. The six-month purge removes some fields from their entries but leaves the entries in the identity system [7][4]. DTU puts the exposure window at anyone who has been an employee, student, guest or external partner since 2003 [9].
The richer records belong to active users. DTU lists CPR numbers, full names, home addresses, profile pictures, work email addresses, job titles and office locations among their exposed data [5]. Where active users registered next of kin, the system also held those relatives' names, relationships and telephone numbers [6]. A caller working from that set can open with the user's name, a relative's name and how the two are related [6]. DTU warns that criminals could use the CPR numbers and other personal data for identity fraud and to make phishing more convincing [8]. Its advice is to distrust emails, texts and calls from anyone who seems to know about a person's DTU connection, and to treat sudden authentication requests or logins as suspicious [12].
"This is a serious attack on DTU, and we deeply regret the uncertainty it is causing for the people whose information may have been affected," University Director Bjarke Bak Christensen said [10].
The intrusion path is short. An attacker used compromised credentials to log into the IAM system, and that access reached more than two decades of user data [2]. The argument for keeping less in an identity system follows from DTU's own inventory. The directory that governs logins also stored national ID numbers, home addresses and family phone numbers [5][6].
The argument for tighter controls on the account that was used cannot yet be tested. The disclosure does not say whose credentials they were, how they were obtained, whether the account required a second factor, or who used them.
What to watch
- DTU stating whose credentials were used and whether that account required a second factor.
- A leak-site post or sale offer for DTUBasen data would show what was actually taken.
- Any regulator finding on why CPR numbers and next-of-kin contacts sat in DTU's identity system.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
DTU says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data.
- [2]
The attacker used compromised credentials to log into DTUBasen, DTU's identity and access management (IAM) system, allowing access to more than two decades of user data.
- [3]
In a disclosure on Friday, DTU said it cannot "determine precisely what information was downloaded or how many people have been affected."
- [4]
DTUBasen stores information for nearly 40,000 active users and around 160,000 former users.
- [5]
Potentially exposed information for current users includes Danish civil registration numbers (CPR), full names, home addresses, profile pictures, work email addresses, job titles, office locations and other employment-related details.
- [6]
The dataset also contained the names, relationships and telephone numbers of users' next of kin, when provided by active users.
- [7]
For former users, home addresses, profile pictures and next-of-kin information are automatically deleted after six months, according to DTU.
- [8]
DTU warns that cybercriminals could use the exposed CPR numbers and other personal data for identity fraud and to make phishing attacks more convincing.
- [9]
DTU says anyone who has been an employee, student, guest or external partner of DTU since 2003 may be affected.
- [10]
"This is a serious attack on DTU, and we deeply regret the uncertainty it is causing for the people whose information may have been affected," said University Director Bjarke Bak Christensen.
- [11]
"DTU only holds CPR numbers for a small number of guests and external partners and does not hold CPR numbers for next of kin whose contact details have been registered in DTUBasen," the organization says.
- [12]
People are advised to be cautious of emails, text messages and phone calls from individuals who appear to know about their connection with DTU, and to treat sudden authentication requests or logins as suspicious.
- [13]
DTU recommends changing passwords for any other services that use the same credentials as the DTU account and placing a credit alert on the affected CPR number.
- [14]
The public disclosure is part of DTU's effort to reach potentially affected individuals it cannot contact directly, and the university is urging people to share it with former employees, students, guests and external partners.
- [15]
The up-to-200,000 figure equals the whole DTUBasen population of active plus former users.
- [16]
Former users make up about 80 percent of the people whose records DTUBasen holds.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comDanish university DTU breach exposes data of up to 200,000 people
1 article · October 3, 2026
- dev.toDTU Breach: IAM Data Theft May Affect Up to 200,000 People
1 article · October 3, 2026
Topics and entities
Entities
- Technical University of Denmark
- Bjarke Bak Christensen