Danish university DTU breach exposes data of up to 200,000 people
Danish university DTU breach exposes data of up to 200,000 people.
The Technical University of Denmark (DTU) has reported a data breach affecting up to 200,000 users after hackers accessed its identity and access management system, DTUBasen. The attackers used compromised credentials to download a significant amount of user data, potentially including Danish civil registration numbers, names, addresses, and next-of-kin information. DTU warns that this data could be used for identity fraud and phishing attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DTUBasen?
Get an email when a new story names DTUBasen, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers gained access to DTU's identity and access management system (DTUBasen) using compromised credentials, enabling them to exfiltrate sensitive personal data on up to 200,000 individuals, including civil registration numbers and next-of-kin information. The root failure lies in insufficient access controls — compromised credentials alone should not be enough to download large volumes of sensitive records without triggering safeguards. This incident highlights how a single point of credential failure in a central IAM system can cascade into a massive data breach. The exposure of civil registration numbers creates serious long-term risks for identity fraud and targeted phishing, making this breach particularly damaging for affected individuals.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.