Hackers download DTU identity data dating back to 2003

Scope of the DTU attack

Hackers accessed the Technical University of Denmark's identity and access management system and downloaded a large amount of data dating back to 2003. The affected system, DTUBasen, holds records on current and former members of the university community.

Threat actors compromised DTU profiles and used them to access DTUBasen. DTU said it cannot currently determine the exact number of people affected, but the database contains records for approximately 40,000 active users and around 160,000 former users. Potentially affected people include current and former employees, students, guests and external partners.

University Director Bjarke Bak Christensen said establishing the extent of the attack, limiting its consequences and notifying potentially affected people were the university's priorities. The investigation is ongoing, and DTU plans to provide further information when available.

Information that may have been exposed

Potentially exposed information includes CPR numbers, full names, home addresses, profile photos, work email addresses, other employment details and next-of-kin information where provided. DTU said personal information and CPR numbers can be used for identity fraud and phishing.

For former users, home addresses, profile pictures and next-of-kin information are automatically deleted after six months. DTUBasen continues to retain CPR numbers and full names for those users.

Advice for potentially affected people

DTU is urging anyone who has been an employee, student, guest or external partner since 2003 to remain alert for suspicious messages, avoid approving unexpected login requests and change passwords on services where the same DTU password was reused. The university also recommends considering a credit alert against a CPR number.

DTU will notify most affected current and former students and employees directly through e-Boks. It is issuing a public notice to reach guests and people it cannot contact individually.

DTU works with the Danish Armed Forces and the defence industry on drone technology and operates a significant defence and security research program. There is currently no indication that the attack was connected to this work.