DTU Confirms Breach of Identity and Access Management System
The Technical University of Denmark (DTU) has disclosed that unauthorized access to its identity and access management system, known as DTUBasen, may have resulted in the exposure of personal data belonging to up to 200,000 individuals. The breach was discovered after attackers used compromised credentials to gain entry to the system, which stores user information spanning more than two decades.
In a statement released on Friday, DTU acknowledged that it is unable to determine exactly what data was accessed or how many individuals were affected. However, the university noted that DTUBasen contains records for approximately 40,000 active users and around 160,000 former users, suggesting the potential scope of the incident.
Types of Data Potentially Exposed
For current users, the exposed information may include Danish civil registration numbers (CPR), full names, residential addresses, profile pictures, work email addresses, job titles, office locations, and other employment-related details. The dataset also includes the names, relationships, and telephone numbers of users’ next of kin, when such information was voluntarily provided.
DTU clarified that for former users, certain data points such as home addresses, profile pictures, and next of kin details are automatically deleted from the system after six months, reducing the potential exposure for individuals who left the university more than half a year prior to the breach.
"This is a serious attack on DTU, and we deeply regret the uncertainty it is causing for the people whose information may have been affected,"
Christensen emphasized that the university’s immediate priorities have been to assess the full extent of the breach, mitigate its consequences, and ensure that affected individuals are informed about the incident and advised on protective steps they can take.
Notification Process and Limitations
DTU will notify all current and former employees through e-Boks, the official digital mailbox system used for institutional communications. However, the university stated that it will not be able to directly notify all current and former students whose CPR numbers are stored in DTUBasen, due to limitations in contact information availability.
The institution clarified that it only maintains CPR numbers for a small subset of guests and external partners, and does not store CPR numbers for next of kin whose contact details were registered in DTUBasen. To reach individuals who cannot be contacted directly, DTU has issued a public disclosure and urged the public to share the information with former employees, students, guests, and external partners who may have been affiliated with the university since 2003.
Guidance for Potentially Affected Individuals
Anyone who has been employed, studied, or otherwise affiliated with DTU as a student, employee, guest, or external partner since 2003 is advised to remain vigilant against phishing attempts, suspicious communications, and unsolicited requests for personal information. DTU specifically warned that cybercriminals could exploit exposed CPR numbers and other personal data to conduct identity fraud or create more convincing phishing messages.
The university recommends that individuals avoid sharing passwords or sensitive data in response to unexpected emails, text messages, or phone calls, even if the sender appears to have knowledge of their DTU affiliation. Sudden authentication requests or login prompts should be treated with suspicion.
Additionally, DTU advises affected individuals to change passwords for any other online services where they may have reused the same credentials used for their DTU account and to consider placing a credit alert on their CPR number to help detect signs of identity misuse.
Source: BleepingComputer