# Compromised Credentials Grant Access to Two Decades of DTU Records

The Technical University of Denmark disclosed that attackers used compromised credentials to access DTUBasen, its identity and access management system, and downloaded data that may affect up to 200,000 current and former users. The system stores records for nearly 40,000 active users and around 160,000 former users accumulated over more than two decades. DTU states it cannot determine precisely which records were taken or how many individuals are affected.

## Scope of Potentially Exposed Data

The DTUBasen system stores information for nearly 40,000 active users and approximately 160,000 former users. Potentially exposed data for current users includes Danish civil registration numbers (CPR), full names, home addresses, profile pictures, work email addresses, job titles, office locations and other employment details. The dataset also contained names, relationships and telephone numbers of next of kin when provided by active users.

DTU notes that for former users, home addresses, profile pictures and next-of-kin information are automatically deleted after six months. The university states that anyone who has been an employee, student, guest or external partner since 2003 may be affected.


## How the Attack Occurred

Attackers used compromised credentials to log into DTUBasen, the university's identity and access management system. The credentials granted access to user data accumulated over more than two decades. University Director Bjarke Bak Christensen stated that establishing the extent of the attack and limiting its consequences has been a priority.

DTU disclosed the breach on Friday but cannot confirm which specific information was downloaded. The organization characterizes the incident as a serious attack and says it regrets the uncertainty for those whose information may have been affected.


## Risks from Civil Registration Numbers

DTU warns that cybercriminals could use the exposed CPR numbers and other personal data for identity fraud. The university also cautions that the stolen information could make phishing attacks more convincing. Danish civil registration numbers are national identifiers used across government and financial systems.

The combination of CPR numbers with employment details, addresses and emergency contacts gives attackers detailed profiles that can be exploited in targeted fraud schemes. Director Christensen noted the seriousness of the exposure in the university's statement.


## Who Will Receive Direct Notification

DTU will notify potentially impacted individuals through e-Boks, the official mailbox system used for sharing documents with students and staff. The university says it will notify all current and former employees but will not notify all current and former students whose CPR numbers are held by DTU.

DTU states it holds CPR numbers for only a limited number of guests and external partners. Next-of-kin records in DTUBasen do not include CPR numbers. The public disclosure is intended to reach potentially affected individuals the university cannot contact directly.


## Protective Steps for Potentially Affected Individuals

DTU advises caution with emails, text messages and phone calls from individuals who appear to know about a connection with DTU or have access to personal information. The university recommends the following protective measures:
1. Be cautious of unexpected messages referencing your DTU connection or personal details
2. Do not share passwords or sensitive data in response to unsolicited communications
3. Treat unexpected authentication requests as suspicious
4. Change passwords for accounts that shared credentials with your DTU login
5. Place a credit alert on your CPR number

## Broader Implications for Identity Systems

The incident highlights risks when identity and access management systems store decades of user records accessible through a single set of compromised credentials. DTU is urging people to share the disclosure with former employees, students, guests and external partners to reach individuals the university cannot notify directly.

The university confirmed it has taken steps to limit consequences of the attack and ensure affected parties know what actions to take. The organization published its disclosure as part of efforts to reach all potentially impacted individuals despite gaps in its ability to contact everyone directly.


## How did attackers access the DTU system

Attackers used compromised credentials to log into DTUBasen, the university's identity and access management system. This allowed them to download a large amount of user data stored over more than two decades.

## What information may have been exposed

Potentially exposed data includes Danish civil registration numbers, full names, home addresses, profile pictures, work email addresses, job titles and office locations for current users. Next-of-kin information including names, relationships and telephone numbers was also stored when provided. Former user records are automatically deleted of some details after six months.

## Will DTU notify everyone affected by the breach

DTU will notify all current and former employees through e-Boks but will not notify all students. The university published a public disclosure to reach individuals it cannot contact directly, including guests and external partners.

## What should potentially affected individuals do

DTU advises being cautious of unexpected communications referencing your DTU connection. Do not share passwords in response to unsolicited messages. Change passwords for accounts that shared credentials with your DTU login and place a credit alert on your CPR number.

## Who may be affected by this breach

Anyone who has been an employee, student, guest or external partner of DTU since 2003 may be affected. The system stores data for nearly 40,000 active users and around 160,000 former users, totaling up to 200,000 potentially impacted individuals.

Source: BleepingComputer
Published: 2026-10-05T00:26:04+00:00