Danish University IAM Breach: A Checklist After Up to 200,000 Records Exposed
DTU says attackers used compromised credentials to reach its identity system and may have exposed data on up to 200,000 people. Here is a practical checklist for any employer watching IAM risk.
The Technical University of Denmark (DTU) disclosed that attackers reached DTUBasen, its identity and access management system, with compromised credentials and downloaded a large amount of data. Up to about 40,000 active and 160,000 former users may be in scope. Universities are not the only organizations holding decades of identity records—this checklist applies widely.
What was at risk
- Active users: Possible exposure includes Danish CPR numbers, names, home addresses, profile pictures, work email, job titles, office locations, and next-of-kin names, relationships, and phone numbers when provided.
- Former users: DTU says home addresses, profile pictures, and next-of-kin details are auto-deleted after six months, but other historical identity data dating back to 2003 may still be relevant.
- Uncertainty: DTU cannot yet say exactly what was downloaded or how many people were affected.
- Follow-on risk: The university warns CPR numbers and personal details can fuel identity fraud and more convincing phishing.
Owner checklist
- Protect IAM like a vault. Identity directories deserve phishing-resistant admin sign-in, monitoring, and strict break-glass procedures.
- Assume credential theft. Compromised passwords still open many IAM doors; prefer passkeys or hardware factors for privileged roles.
- Minimize retained personal data. Delete next-of-kin and home-address fields when no longer needed.
- Plan notifications early. DTU is using official mailboxes and a public notice for people it cannot email directly—know your legal and practical contact paths before an incident.
- Warn staff about callback phishing. After identity leaks, crooks often impersonate IT or HR with accurate personal details.
What this means for your company
HR and directory systems are high-value targets even when they are not customer databases. If someone can empty your IAM export, they can impersonate your people for months.
Need help hardening identity systems and reducing employee-data exposure? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
Facts in this checklist come from BleepingComputer’s report on the DTU identity-system breach.
About The Author
