[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flcI3tGDwyprOdGWicmlPJsDYIPvd1JwjJgoORg3RH4I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":52},"665fce80-b0f9-49bf-bf89-f1b22d51e876","compromised-credentials-expose-200000-dtu-users-personal-data","c97356cc-37ba-44c5-ae77-07ae32ae6560","Compromised Credentials Expose 200,000 DTU Users' Personal Data","Attackers gained access to DTU's identity and access management system (DTUBasen) using compromised credentials, enabling them to exfiltrate sensitive personal data on up to 200,000 individuals, including civil registration numbers and next-of-kin information. The root failure lies in insufficient access controls — compromised credentials alone should not be enough to download large volumes of sensitive records without triggering safeguards. This incident highlights how a single point of credential failure in a central IAM system can cascade into a massive data breach. The exposure of civil registration numbers creates serious long-term risks for identity fraud and targeted phishing, making this breach particularly damaging for affected individuals.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) on all accounts with access to identity and access management systems.\n- Reset and rotate all credentials associated with DTUBasen and audit active sessions for unauthorized access.\n- Notify affected individuals promptly and advise them to monitor for identity fraud and phishing attempts.\n\n**Long-term improvements:**\n- Implement the principle of least privilege so that no single credential can bulk-download the entire user database.\n- Apply data minimization practices by limiting what sensitive fields (e.g., civil registration numbers) are stored in or exposed by the IAM system.\n- Introduce role-based access controls (RBAC) with strict separation of duties for administrative IAM functions.\n\n**Detection measures:**\n- Deploy anomaly detection and UEBA (User and Entity Behavior Analytics) to flag bulk data downloads or unusual query patterns in IAM systems.\n- Enable comprehensive audit logging on all IAM system access, with alerts for high-volume data retrieval events.\n- Conduct regular access reviews and credential hygiene checks to identify and revoke stale or compromised accounts.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 AU-6 – Audit Review, Analysis, and Reporting","GDPR Article 5(1)(c) – Data Minimization","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 33 – Notification of a Personal Data Breach","NIST CSF PR.AC-1 – Identities and Credentials Management","ISO\u002FIEC 27001 Annex A.9 – Access Control",{},"published","2026-10-03T16:20:53.33154+00:00","2026-10-03T16:20:53.017+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fdanish-university-dtu-breach-exposes-data-of-up-to-200-000-people\u002F","danish-university-dtu-breach-exposes-data-of-up-to-200-000-people-c24f61","Danish university DTU breach exposes data of up to 200,000 people",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[46],{"id":47,"date":48,"edition":49,"title":50,"audio_url":51},"b242eafd-11a9-421e-964c-d7026ac0e911","2026-10-04","morning","ThreatNoir Weekend Brief — October 4","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-04\u002Fthreatnoir-morning-brief-2026-10-04.mp3",[53,57,61],{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":62,"name":63,"problem":64},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]