Hackers gained unauthorized access to DTU's identity and access management system (DTUBasen) by using compromised credentials. This access allowed them to download a large amount of user data spanning over two decades. The affected data includes sensitive personal information such as CPR numbers, names, addresses, employment details, and next of kin information for nearly 40,000 active users and approximately 160,000 former users. Former users' sensitive data like home addresses and next of kin details are automatically deleted after six months, but the exact data exfiltrated remains undetermined. DTU is notifying affected current and former employees and some users via the official e-Boks system and has publicly disclosed the breach to reach others. The breach poses risks of identity fraud and targeted phishing attacks using the exposed personal data.

The breach exposed sensitive personal and employment-related information of up to 200,000 individuals connected to DTU, including Danish civil registration numbers (CPR), which can be used for identity fraud. The exposure of next of kin data increases privacy risks. The compromised credentials allowed attackers to access and download data from the university's identity and access management system, potentially enabling further targeted phishing or social engineering attacks. The university cannot confirm the exact scope of data downloaded, increasing uncertainty for affected individuals.

DTU is notifying affected individuals through the official e-Boks system where possible and has publicly disclosed the breach to reach others. Affected persons are advised to be vigilant against phishing attempts and social engineering attacks that may use the exposed personal data. They should avoid disclosing passwords or sensitive information in response to unexpected communications and treat sudden authentication requests with suspicion. Changing passwords for DTU accounts and any other services using the same credentials is recommended. Placing a credit alert on the affected CPR number is also advised. No official patch or fix applies as this is a breach due to compromised credentials rather than a software vulnerability.