Hackers Breach Technical University of Denmark, Exposing CPR Numbers for 200,000 Users

Hackers compromised the identity and access management system at the Technical University of Denmark (DTU), potentially exposing sensitive personal data for up to 200,000 individuals. The dataset includes records for nearly 40,000 active users and 160,000 former students and staff, dating back to 2003. Attackers bypassed the DTUBasen system by utilizing compromised credentials, granting them access to Danish civil registration numbers (CPR), home addresses, work emails, and profile pictures. The compromised database also contained the names, relationships, and telephone numbers of users’ next of kin. Administrators admitted they cannot precisely verify what specific data the attackers downloaded or exactly who is affected, forcing the institution to issue a broader public warning to reach former employees and guests. "This is a serious attack on DTU, and we deeply regret the uncertainty it is causing for the people whose information may have been affected." — Bjarke Bak Christensen