According to the Technical University of Denmark (DTU), information of up to 200,000 users may have been exposed after hackers accessed their identity and access management system and downloaded large amounts of data.
The university says the attacker used compromised credentials to log into DTUBasen, its identity and access management (IAM) system, allowing access to more than two decades of user data.
In a disclosure on Friday, the DTU confirmed that it “cannot determine exactly what information was downloaded or how many people were affected.”
However, the Danish university notes that DTUBasen stores information from almost 40,000 active users and around 160,000 former users.
Details of the next of kin were also disclosed
Potentially disclosed information for current users includes Danish Civil Registration Numbers (CPR), full names, home addresses and profile pictures, as well as business email addresses, job titles, office locations and other employment-related details.
The dataset also included the names, relationships, and phone numbers of users’ next of kin, if provided by active users.
The DTU points out that for former users, information about home addresses, profile pictures and information about next of kin are automatically deleted after six months.
“This is a serious attack on the DTU and we deeply regret the uncertainty it causes for the people whose information may have been affected,” says university director Bjarke Bak Christensen.
“Our first priority was to determine the scale of the attack, limit its impact and ensure that those affected are notified and know what steps to take,” the director added.
DTU warns that cybercriminals could use the exposed CPR numbers and other personal information for identity fraud and to make phishing attacks more convincing.
Not everyone notified directly
Potentially affected individuals will be notified via e-Boks, the official mailbox system that DTU uses to exchange documents and communications with students and staff.
However, the university says it will notify all current and former employees, but not all current and former students whose CPR numbers are on file with DTU.
“DTU only has CPR numbers for a small number of guests and external partners and does not have CPR numbers for next of kin whose contact details have been registered in DTUBases,” the statement said organization says.
The public disclosure is part of DTU’s efforts to reach potentially affected individuals it cannot contact directly, and the university urges people to share it with former employees, students, guests and external partners.
The organization says anyone who has been an employee, student, guest or external partner of DTU since 2003 could have been affected by the data breach.
You are advised to be cautious about emails, text messages and phone calls from anyone who appears to know of your association with DTU or has access to personal information about you.
Passwords and sensitive information should not be revealed in responses to unexpected communications, and sudden authentication requests or logins should be treated as suspicious.
Additionally, it is recommended to change passwords for all other services that use the same credentials as the DTU account and place a credit alert on the affected CPR number.
