By Hamza Faisal
The Technical University of Denmark (DTU) disclosed on Friday that hackers breached its central identity and access management system and downloaded a large amount of data, potentially exposing personal information belonging to up to 200,000 current and former students, employees, guests and partners.
In an official notice published on October 2, the university said attackers compromised university user profiles and used them to gain access to DTUBasen, the system it uses to manage digital identities and access rights. The database contains personal records stretching back to 2003, covering roughly 40,000 active users and 160,000 former users.
DTU says its IT emergency response has contained the attack and is working with external security specialists to determine exactly which data was extracted and how many people are affected — questions the university says it cannot yet answer precisely.
A treasure trove of identity data
For active users, DTUBasen can hold Denmark's civil registration number — the CPR number, a highly sensitive national identifier — alongside full names, home addresses, profile pictures, work email addresses, job titles and office locations.
Where users registered an emergency contact, the database may also store that person's name, relationship and telephone number.
For former users, home addresses, profile pictures and information about relatives are automatically deleted after six months. However, DTU says the database continues to retain CPR numbers and full names even after users leave.
The university has not established whether all these categories of information were actually downloaded by the attackers.
Identity fraud and phishing warnings
DTU warns that if CPR numbers and other personal data reached unauthorized parties, the information could be used for identity fraud or make phishing attempts and other misuse far more convincing.
Anyone who has worked, studied, visited or collaborated with DTU since 2003 is being urged to be particularly cautious about unexpected emails, text messages, phone calls and login requests.
People who reused their DTU password on other services are being advised to change it immediately. Potentially affected users can also consider placing a credit warning on their CPR number, the university said.
Regulators notified as investigation continues
The breach has been reported to the Danish Data Protection Agency, Datatilsynet, and handed to the relevant authorities for further investigation. Current and former employees, along with almost all current and former students for whom DTU holds a CPR number, are being notified through Denmark's digital mailbox system, e-Boks.
Because DTU cannot directly contact every guest, partner or relative whose details may be stored in the database, it has also issued a public notification. University director Bjarke Bak Christensen described the incident as serious.
"This is a serious attack on DTU, and we deeply regret the uncertainty it creates for the people whose information may have been affected," he said, adding that the university's first priority has been to determine the attack's extent, limit its consequences and make sure those affected know what to do.
The attack lands amid a "very high" threat level for cyber espionage and cybercrime against Danish universities, according to the Danish Centre for Cyber Security, which has repeatedly warned that foreign actors target research institutions worldwide.
