The Technical University of Denmark said an attacker logged in to its central identity and access management system with compromised credentials and downloaded large amounts of personal data, potentially affecting up to 200,000 current and former students and staff. BleepingComputer reported the disclosure Saturday. The exposed data includes Danish CPR civil registration numbers, the national identifier used across public and private services.

What Happened

The breached system, called DTUBasen, manages identities and access rights for people connected to the university. It holds user records going back to 2003, which is why the potential victim pool is far larger than DTU's current population: the university counts about 40,000 active users and about 160,000 former users among those who may be affected.

According to DTU's disclosure, published Friday, the attacker obtained:

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen
  • CPR numbers, full names, home addresses and profile photos
  • Work email addresses, job titles and office locations
  • Names, relationships and phone numbers of next of kin

DTU said it cannot determine precisely what information was downloaded or how many people were affected. University director Bjarke Bak Christensen called it a serious attack on DTU and said the university deeply regrets the uncertainty it is creating for people whose information may have been exposed.

BleepingComputer's report does not name an attacker, mention a ransom demand or say when the intrusion began. It also does not say how the credentials were obtained.

Why It Matters

A CPR number is assigned at birth or registration and generally stays with a person for life. It is used to identify Danes in banking, health care, tax and government services, so unlike a password it cannot easily be changed after a leak. That makes the exposure a long-term fraud risk, especially when combined with addresses, photos and family contacts.

The next-of-kin data widens the circle further. People who never studied or worked at DTU may now have their names, phone numbers and relationship to a DTU user in the stolen set, which could be used to make phishing or phone scams more convincing.

DTU warned that the stolen CPR numbers could be used for identity fraud and targeted phishing. It advised people to be cautious with unsolicited messages and unexpected login or authentication requests, never to share passwords or sensitive information, to change passwords on other services where they reused the same credentials and to place alerts on their CPR numbers.

Context

The scale of the breach reflects a common pattern in university systems: identity platforms keep accounts for alumni and former employees long after they leave, so a single compromised login can reach decades of records. Using valid credentials also lets an intruder move through a system without exploiting a software flaw, which can delay detection.

DTU, based in Kongens Lyngby north of Copenhagen, is one of Denmark's largest technical universities.

What to Watch

Key open questions are whether a criminal group claims the attack or leaks the data, how the attacker obtained working credentials, how long they had access and whether Denmark's data protection authority, Datatilsynet, opens a review. DTU may also be able to narrow its estimate of affected people as its investigation continues.