DTU Breach Exposes Personal Data and CPR Numbers of 200,000

An intruder using compromised credentials successfully accessed DTUBasen, the central Identity and Access Management (IAM) platform for the Technical University of Denmark (DTU), leading to the exposure of personal records belonging to up to 200,000 individuals. The compromised database contains more than two decades of account records dating back to 2003, highlighting the operational risks associated with long-term identity retention in centralized access systems.

Unauthorised Access to the DTUBasen IAM System

The DTU breach occurred after threat actors obtained valid user credentials and logged directly into DTUBasen. In modern enterprise architecture, IAM systems act as the primary authoritative store for user identity, authentication attributes, and role-based permissions. Because these platforms federate identity across faculty, students, administrative staff, contractors, and external partners, a single authenticated intrusion into the IAM backend often yields broad visibility into historical and active records across the entire organization.

The university confirmed that while malicious actors managed to download a significant volume of data, technical responders have been unable to determine the precise set of stolen files or the exact number of impacted individuals. Educational institutions frequently face identity lifecycle challenges, where student and researcher accounts remain stored in active administrative directories long after the individuals have left the institution. This systemic persistence directly expanded the blast radius of the DTUBasen data breach, dragging 21 years of historical user records into the scope of the exposure.

What Was Exposed and Who Is Affected

The database holds identity entries for approximately 40,000 active users and roughly 160,000 former users who maintained an account with DTU at any point since 2003. The depth of the exposed information varies based on whether the record belongs to an active or former affiliate:

• Active Users: Potentially exfiltrated fields include Danish civil registration numbers (CPR numbers), full legal names, home addresses, profile photographs, work email addresses, job titles, physical office locations, and internal employment metadata. Where provided by active users, emergency next-of-kin information—specifically full names, family relationships, and telephone numbers—was also accessible.
• Former Users: DTU enforces an automated data minimization policy that deletes home addresses, profile pictures, and next-of-kin entries six months after an account transitions to inactive status. However, core identity attributes—including CPR numbers, names, and university history—remain permanently archived within DTUBasen and were accessible during the incident.

DTU noted that CPR numbers were not held for next-of-kin contacts, nor for the vast majority of external guests or visiting partners whose contact details were stored in the directory.

The Impact of Exposed CPR Numbers and Next-of-Kin Data

The exposure of Danish CPR numbers creates a severe long-term identity threat for affected individuals. Within Denmark, CPR numbers serve as primary national identifiers needed to interact with government agencies, access public services, open bank accounts, sign lease agreements, and request credit lines. When combined with full names, physical addresses, and employment records, stolen CPR numbers give threat actors the exact data required to execute targeted identity theft, open fraudulent lines of credit, or attempt financial account takeovers.

Additionally, the exfiltration of emergency next-of-kin details provides threat actors with highly effective material for targeted social engineering. Adversaries routinely use secondary contact networks to craft convincing spear-phishing lures, such as fake emergency communications, impersonation schemes targeting family members, or high-urgency extortion calls designed to pressure victims into transferring funds or handing over account access.

Response Efforts and Recommended Actions

DTU is notifying current and former employees, as well as select students, using e-Boks—the official Danish digital mailbox infrastructure used by public institutions. Because the university lacks up-to-date direct contact details for all historical students, guests, and external partners connected to the university since 2003, it issued a public disclosure requesting that community members help inform former peers and colleagues who may be affected by the Technical University of Denmark breach.

Individuals who have interacted with DTU over the last two decades should take immediate defensive measures:

• Activate CPR Credit Alerts: Impacted individuals should place a credit warning (kreditadvarsel) on their CPR number through Denmark’s official public administration portal (borger.dk) to prevent unauthorized credit creation or fraudulent financial sign-ups.
• Credential Hygiene and Password Reset: Users who reused their DTU password across personal email, banking, or third-party web services should immediately change those credentials on all external platforms.
• Vigilance Against Targeted Phishing: Affected parties should maintain high suspicion regarding incoming emails, SMS messages, or phone calls referencing their connection to DTU or demonstrating knowledge of personal background details. Legitimate organizations will never request passwords, multi-factor authentication (MFA) approval codes, or full CPR numbers over unsolicited communications.
• Audit IAM Retention Schedules: Security teams operating higher education or enterprise directories should review historical user retention policies. Archives of legacy accounts should be stripped of high-value national identification numbers or moved to air-gapped, encrypted cold storage rather than remaining exposed inside live identity systems.