Université technique du Danemark (DTU)
CriticalReportedEducation
The Technical University of Denmark (DTU) announced on 2 October 2026 that an attacker logged into DTUBasen, its identity and access management system, using compromised credentials and downloaded a large amount of data. The university says it cannot determine precisely which information was taken or how many people are affected; the system holds data on about 40,000 active users and 160,000 former users, covering more than two decades.
A CPR number combined with a name and address can be used for identity fraud and to make phishing attempts more convincing.
- Disclosed on
- October 2, 2026
- Accounts affected
- 200,000
- Sector
- Education
- Country
- Denmark
- Cause
- Credential stuffing
Exposed data
- Full name
- Postal address
- Identity document
- Email address
- Employment data
- Phone number
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact