If you’ve ever been a student, employee, guest, or external partner at DTU since 2003, this breach could involve you. Attackers got into DTU’s identity system (DTUBasen) using compromised credentials and downloaded a large amount of data—DTU has said it can’t confirm exactly what was taken or exactly how many people are impacted. That uncertainty is the worst part: you may be at risk even if you never get a clear “yes, your record was accessed.” Let’s break down what might be exposed, who’s most likely affected, how DTU plans to notify people, and the practical steps that actually reduce your risk right now.
What happened—and why DTU can’t give a perfect list of “who was hit”
DTU says attackers got in using compromised credentials and logged into DTUBasen, the university’s identity and access management (IAM) system, then downloaded a large amount of data.
If “IAM system” sounds abstract, here’s the plain version: it’s the gatekeeper that ties your identity (who you are) to your access (what you can log into). At a university, that can connect to a lot of places at once—accounts, profiles, and directories that other systems rely on. That’s why a DTUBasen/IAM breach isn’t just “one database got scraped.” It’s an attack on the system that knows who you are inside DTU’s ecosystem and often holds the data needed to manage those identities.
DTU also said the part that makes people uneasy: it can’t “determine precisely what information was downloaded or how many people have been affected.”
That line matters. It usually means some combination of these realities is true:
- Bulk access looks like normal access once an attacker is logged in with real credentials. If the system sees a “valid user,” the download can blend into legitimate activity.
- Logs don’t always answer the big question: exactly which records were viewed/exported, and exactly which individuals’ data was included—especially if the attacker pulled data in batches.
- Two decades of history increases uncertainty. DTU’s disclosure points to access to more than two decades of user data (dating back to 2003), which expands both the potential dataset and the investigative complexity.
What should you do with that uncertainty? Don’t wait for perfect confirmation. Treat this like risk management, not a yes/no verdict.
A practical way to interpret DTU’s message is: If you’ve ever had a DTU identity in DTUBasen, assume your personal details may be in scope until proven otherwise. DTU itself frames the potential scope broadly—anyone who has been an employee, student, guest, or external partner since 2003 may be affected.
And that’s why DTU can’t hand you a clean list of “who was hit.” The attacker didn’t need to break a window—they walked in with keys.
What personal data might have been exposed (and what that enables)
When attackers pull data from an identity system like DTUBasen, the immediate risk isn’t just “privacy.” It’s precision targeting: messages and calls that sound like they came from DTU, your department, or someone who has no business knowing your details.
DTU has said the following may have been exposed for current users: CPR numbers, full names, home addresses, profile pictures, work email addresses, job titles, office locations, and other employment-related details . Here’s what each piece can enable in real life.
Data categories that matter (and why criminals want them)
- CPR number (civil registration number)
This is the heavy hitter. DTU warns CPR numbers and related personal data could be used for identity fraud and to make phishing more convincing . Even when a scammer can’t “do everything” with a CPR alone, it’s often used as a credibility weapon: “We need to confirm your CPR to unlock your account / issue your refund / update payroll.”
- Full name + home address
Enough to make a fake email, letter, or call feel official. It also helps scammers answer common “verification” questions that many services still use.
- Profile photo
It sounds harmless until someone uses it to impersonate you in a chat, a fake LinkedIn profile, or a spoofed internal message that “looks” like the right person.
- Work email address
A direct route for spear-phishing. If the attacker knows your DTU role, they can pick the right pretext: “IT access review,” “lab safety update,” “contract renewal,” “new payroll portal,” you get the idea.
- Job title + office location + employment-related details
This is what turns a generic scam into a believable one. The message doesn’t have to be perfect—just specific: correct building name, department wording, or manager/HR references.
Next-of-kin data: the “relationship context” problem
DTU also says the dataset contained names, relationships, and telephone numbers of users’ next of kin, when the user provided them . That’s a different kind of risk.
Relationship context is powerful because it shortcuts your skepticism. A scammer doesn’t have to guess what will make you respond; they can:
- Pose as HR or a department admin: “We couldn’t reach you, so we contacted your emergency contact.”
- Trigger urgency with a family angle: “This is regarding your listed next of kin—please confirm details now.”
- Use the next-of-kin phone number for cross-channel pressure (text you, then call your contact, then email you), making it feel like “something is happening.”
DTU’s own warning is blunt: exposed personal data can make phishing attacks more convincing . If you’re trying to assess your risk, don’t focus only on “can they steal money instantly?” Focus on “can they make me believe a lie long enough to hand over access?”
Who’s most likely affected: current users, former users, and the 2003 problem
If you’re trying to answer “am I in this?”, DTU’s own numbers make the scope hard to ignore.
DTU says DTUBasen stores information for nearly 40,000 active users and around 160,000 former users . And DTU’s public guidance is broader than most people expect: anyone who has been an employee, student, guest, or external partner since 2003 may be affected .
That “since 2003” detail is the real gut punch. It turns this from a “current students and staff” issue into a long-tail risk for people who haven’t thought about DTU in years.
Current users: easiest to target, easiest to spook
If you’re a current student or employee, you’re the simplest person to manipulate because:
- You’re actively using DTU services, so a fake “account issue” message feels plausible.
- You’re more likely to respond quickly, because you don’t want to lose access.
You don’t need to be the highest-value target. You just need to be reachable and busy.
Former users: still valuable, even if you left ages ago
A lot of people assume, “I graduated years ago, so my data’s gone.” DTU’s own numbers suggest the opposite: the former-user population is much larger than the active one .
Former-user records still matter because scammers don’t need a live DTU login to exploit you. They just need enough verified-looking detail to:
- Prove they “know you” (DTU affiliation is a strong credibility hook)
- Pick the right angle (research group, department, employment period)
- Start a conversation that ends with you sharing something sensitive
The retention nuance: what DTU says gets deleted vs. what may still exist
DTU notes that for former users, certain fields—home address details, profile pictures, and next-of-kin information—are automatically deleted after six months .
That’s helpful, but it’s not a free pass.
Here’s the practical takeaway: some details may age out, but the identity record itself can still exist for a long time in systems like an IAM directory. And since DTU also says it can’t precisely determine what was downloaded , you’re better off thinking in ranges:
- Best case: your former-user record had fewer “fresh” fields left in it
- Still possible: identifiers and institutional ties remained long after you left
So if you had any relationship with DTU going back to 2003—student, employee, guest, external partner—treat yourself as “possibly included,” even if your DTU email stopped working a decade ago .
Notifications via e‑Boks (and why you might never get a message)
After a breach, most people wait for the official “you were affected” notice before doing anything. DTU’s setup makes that risky.
DTU says potentially impacted individuals will be notified through e‑Boks, the official mailbox system DTU uses to share notices with students and staff . That sounds straightforward—until you read the fine print.
The key nuance: silence doesn’t mean you’re safe
DTU also says it will notify all current and former employees, but not all current and former students whose CPR numbers are held by DTU .
What that means in practice:
- You can be in the group that’s potentially affected and still never receive a direct e‑Boks notification.
- If you’re a former student (or someone loosely tied to DTU), the lack of a message can’t be treated as “confirmation I’m fine.”
- Attackers know this gap exists. It creates confusion, and confused people click links.
DTU also made the disclosure public partly to reach people it can’t contact directly, and it encouraged sharing the notice with former employees, students, guests, and external partners . That’s a polite way of saying: “We might not be able to individually message everyone.”
While you wait, treat DTU-themed outreach like it’s hostile
DTU warns people to be cautious of emails, texts, and phone calls from someone who seems to know about their DTU connection or personal details . Use this checklist:
- Assume urgency is a tactic. “Fix your account in 30 minutes” is how scammers rush you past common sense.
- Don’t “solve” breach issues through a link. If a message pushes you to log in, update details, or confirm anything, pause. Go to the service by typing the address yourself.
- Verify the channel, not the story. A convincing story is easy when personal data is involved. The real test is: is this coming through the official path you already trust (like e‑Boks), and can you validate it independently?
- Don’t share passwords or sensitive info in replies. DTU explicitly advises not to disclose passwords/sensitive data in response to unexpected communications .
- Treat unexpected authentication prompts as suspicious. DTU calls out sudden authentication requests/logins as a red flag .
If you do get a message claiming to be from DTU, the safest mindset is simple: you’re not proving you’re careful by spotting one obvious fake. You’re proving it by not being rushed into the second step—the click, the login, the “confirm your info” flow that hands control away.
What to do right now: a tight, practical playbook to cut your risk
If you’re waiting for “final answers” before acting, you’ll be waiting while scammers test what works. DTU’s own advice is clear: assume phishing and impersonation attempts will follow, and move fast on the steps that actually reduce damage .
1) Shut down the easiest win: password reuse
DTU recommends changing passwords on any other services where you used the same credentials as your DTU account .
Do it in this order (highest impact first):
- Email accounts (personal + work)
- Banking / payments / mobile carrier
- Social accounts (Facebook/Instagram/LinkedIn)
- Everything else
Use a new password for each. If one site gets hit later, it won’t domino into the rest.
2) Treat surprise login/MFA prompts as an attack, not “a glitch”
DTU explicitly warns that sudden authentication requests or logins should be treated as suspicious .
What to do when it happens:
- Don’t approve any unexpected push notification.
- Don’t enter codes you didn’t request.
- Change the password on the account that triggered the prompt (from the official app/site, not a link).
3) Get disciplined about messages that “know” you
DTU advises people to be cautious of emails, texts, and phone calls that reference your DTU connection or personal details . The point is simple: scammers will use real facts to sell a fake story.
Rules that hold up under pressure:
- Don’t share passwords or sensitive info in replies to unexpected outreach .
- If someone claims to be DTU/IT/HR, hang up and call back using a number you find yourself (not the one they give you).
- If you’re pushed to “fix your account,” go straight to the service by typing the address yourself.
4) Consider a credit alert tied to your CPR number
DTU recommends placing a credit alert on the affected CPR number . This is one of the few steps that can reduce the impact of identity misuse beyond inbox cleanup.
5) Add a privacy layer for the next few weeks (so scammers hit dead ends)
After a breach, your inbox and phone can become the “front door” attackers keep knocking on. You can lower the value of exposed contact data by using masked emails and phone numbers for new signups and non-critical accounts.
A practical setup:
- Use an alias email for newsletters, online stores, and one-off registrations
- Use a separate number (or phone alias) for services that tend to spam or get resold
Tools like Cloaked help here by letting you create email and phone aliases, so you’re not handing out your real inbox or real number every time you register for something. It’s not a magic shield, but it does something useful: it limits how far spam and targeted phishing can follow you when your personal details are already circulating.
