The DTU data breach may have exposed personal information belonging to up to 200,000 current and former university users. Attackers used compromised credentials to access the Technical University of Denmark’s identity and access management system, DTUBasen.
DTU says the intruder downloaded a large amount of data. However, the university cannot confirm exactly which information the attacker took or how many people the incident affected.
The system holds records for nearly 40,000 active users and around 160,000 former users. Consequently, those figures represent the potentially affected population rather than a confirmed count of victims.
University Records Extend Back More Than Two Decades
DTU says anyone connected to the university as an employee, student, guest or external partner since 2003 may be affected.
For active users, potentially exposed details include Danish civil registration numbers, known as CPR numbers, alongside names, home addresses and profile pictures.
The system also stores work email addresses, job titles, office locations and other employment information. Together, these details could help criminals create convincing messages that reference a person’s university connections.
However, the available disclosure does not establish when attackers first gained access or how they obtained the compromised credentials.
Emergency Contact Details May Also Be Affected
The potential exposure extends beyond people who hold university accounts. Where active users supplied emergency contacts, DTUBasen also contained their next of kin’s names, telephone numbers and relationships.
However, DTU says it does not store CPR numbers for these relatives.
The university also applies different retention rules to former users. It automatically deletes their home addresses, profile pictures and next-of-kin information after six months.
As a result, the information potentially available to attackers varies between current and former users.
Direct Notifications Will Not Reach Everyone
DTU is using e-Boks to send breach notifications to potentially affected individuals. The university uses this digital mailbox service to communicate with students and staff.
It says it will notify all current and former employees. However, its direct notifications will not reach every current or former student whose CPR number it holds.
Meanwhile, DTU holds CPR numbers for only a small proportion of guests and external partners.
The public announcement therefore forms part of its effort to reach people it cannot contact directly. DTU has also asked readers to share the notice with former university contacts.
University Warns About Fraud and Targeted Messages
DTU warns that criminals could misuse exposed CPR numbers and personal details for identity fraud or more convincing phishing attempts.
People potentially affected by the DTU data breach should approach unexpected emails, texts and calls cautiously. Knowing someone’s university connection or personal information does not prove that a sender is legitimate.
The university also advises against sharing passwords or sensitive details in response to unexpected communications. Likewise, users should treat unrequested authentication prompts and unfamiliar login activity as suspicious.
Its guidance includes changing passwords on other services that share the same credentials as a DTU account. Additionally, it recommends placing a credit alert on an affected CPR number.
DTU says its priorities include establishing the scope of the intrusion, limiting its consequences and informing those potentially affected.
0 responses to “DTU Data Breach May Affect Up to 200,000 People”