DTU Data Breach May Expose CPR Numbers and Personal Records of 200,000 Users

The headline number needs an important qualification: 200,000 is the approximate population of the database, not a confirmed count of people whose information was stolen. DTUBasen holds records for around 40,000 active users and 160,000 former users. DTU cannot establish precisely which information was downloaded or how many people were affected.

Personal records extend back to 2003​

As BleepingComputer reports, the potentially affected population includes employees, students, guests, and external partners connected with DTU since 2003. For active users, potentially exposed information includes:

• Danish civil registration numbers, known as CPR numbers.
• Full names, home addresses, and profile pictures.
• Work email addresses, job titles, office locations, and other employment details.
• Registered next-of-kin names, relationships, and telephone numbers.

For former users, DTU automatically deletes home addresses, profile pictures, and next-of-kin information after six months. However, the university’s own notice confirms that records including CPR numbers and full names remain in DTUBasen. Leaving the institution therefore does not necessarily remove someone from the potentially affected population.

DTU warns that exposed personal information could support identity fraud and more convincing phishing attempts. It also highlights a particular concern for people with name-and-address protection: disclosure could increase the risk of unwanted contact, being located, or harassment. These are potential consequences, not confirmation that such misuse has occurred.

Not everyone will receive a direct notification​

DTU says current and former employees, and almost all current and former students for whom it holds CPR numbers, will receive notifications through e-Boks. Its public notice is also intended to reach people it cannot contact directly.

The university holds CPR numbers for relatively few guests and external partners, and none for next of kin registered in DTUBasen. Consequently, the absence of an e-Boks notification should not be treated as proof that someone is unaffected—a practical inference from DTU’s stated notification limits.

What potentially affected people should do​

DTU recommends several precautions:

1. Scrutinize unexpected emails, texts, and calls, even when the sender knows about your connection to the university.
2. Do not disclose passwords or confidential information in response to unexpected requests.
3. Reject authentication requests you did not initiate.
4. Change passwords elsewhere if you reused your DTU password.
5. Consider adding a credit warning to your CPR record.

Knowing a person’s employer, job title, or family contact does not make a caller trustworthy. In this incident, those very details may be among the information exposed.

A Danish credit warning is not a universal fraud block​

Denmark’s official citizen portal, Borger.dk, explains that a kreditadvarsel flags a CPR record to encourage additional identity checks before loans or credit are granted. Companies choose whether to receive these warnings, so the measure should not be presented as a guarantee against identity fraud. It can also make legitimate borrowing more difficult.

For those considering the measure, the official procedure is:

1. Open Borger.dk’s credit-warning self-service.
2. Select Start and sign in with MitID. The self-service is in Danish.
3. Use the service to add the warning; users must be at least 15 years old.
4. Confirm the warning through CPR register access. Borger.dk says registration takes effect immediately in CPR, although companies’ systems may take several days to reflect it. Anyone unable to complete the online process can book assistance with their municipality’s Citizen Service centre.

What remains unknown​

DTU has reported the incident to the Danish Data Protection Agency and referred it to relevant authorities. External specialists are assisting the university’s investigation. Its disclosure does not identify how the DTU profiles were initially compromised or establish a particular software vulnerability, ransomware operation, or Microsoft-product involvement.

For enterprise IT readers, the central lesson is a distinction rather than a verdict on DTU’s controls: access protection and data retention deserve separate scrutiny. The university’s six-month deletion policy limits some former-user information, but retained identifiers still place those users within the incident’s potential scope. That makes this more than an account-security story—it is also a reminder that historical identity records carry present-day risk.