DTU Breach May Expose Data of Up to 200,000 People

The Technical University of Denmark (DTU) says information belonging to up to 200,000 people may have been exposed after an attacker accessed its identity and access management system and downloaded data.

DTU says the attacker used compromised credentials to log into DTUBasen, which stores more than two decades of user data. The university says it cannot determine precisely what was downloaded or how many people were affected. DTUBasen holds information for nearly 40,000 active users and around 160,000 former users.

Potentially exposed information about current users includes Danish civil registration numbers (CPR), names, home addresses, profile pictures, work email addresses, job titles, office locations and other employment details. The data also included names, relationships and telephone numbers of next of kin, when active users had provided them. For former users, home addresses, profile pictures and next-of-kin information are automatically deleted after six months.

DTU says it will notify current and former employees, but not all current and former students whose CPR numbers it holds. It plans to contact potentially affected people through e-Boks. The university says anyone who has been a DTU employee, student, guest or external partner since 2003 may be affected. It warns that exposed personal data could be used for identity fraud or to make phishing attempts more convincing.