Danish university DTU breach exposes data of up to 200,000 people

The Technical University of Denmark (DTU) says the personal data of up to 200,000 people may have been exposed after a cyberattack. Intruders gained access to DTUBasen, the university's identity and access management system, and downloaded a large amount of information.

According to the university, the attackers used compromised credentials to log into DTUBasen, opening the door to records accumulated over more than two decades. In a disclosure on Friday, DTU admitted it cannot "determine precisely what information was downloaded or how many people have been affected."

The system holds data on nearly 40,000 active users and around 160,000 former ones.

Next of kin data exposed too

Potentially exposed information for current users includes Danish civil registration numbers (CPR), full names, home addresses and profile pictures, as well as work email addresses, job titles, office locations and other employment details. The dataset also contained the names, relationships and telephone numbers of users' next of kin, where active users had provided them.

The university notes that for former users, home addresses, profile pictures and next-of-kin information are automatically deleted after six months.

"This is a serious attack on DTU, and we deeply regret the uncertainty it is causing for the people whose information may have been affected," said University Director Bjarke Bak Christensen. His first priority, he said, was to establish the scope of the attack, limit its consequences and notify those affected.

The university warns that the exposed CPR numbers and other personal data could be used for identity fraud and to make phishing attacks more convincing.

Not everyone notified directly

Affected individuals will be contacted through e-Boks, the official mailbox system DTU uses for correspondence with students and staff. However, the university can notify all current and former employees but not all students whose CPR numbers it holds.

To reach those it cannot contact directly, DTU has issued a public disclosure, urging people to share it with former employees, students, guests and external partners. Anyone connected to DTU since 2003 may be affected.

People are advised to be wary of emails, texts and calls from anyone who appears to know of their link to the university, not to disclose passwords in reply to unexpected messages, to treat sudden login requests as suspicious, to change passwords on other services using the same credentials, and to place a credit alert on their CPR number.

Source: Bleeping Computer