DTU has identified a serious personal data breach involving DTU’s identity and access management system, DTUBasen. In a targeted cyberattack, unauthorised persons gained access to the system and downloaded a large amount of data.
DTU’s IT incident response team has contained the attack and has been working with external specialists to investigate its extent.
The attack involved unauthorised persons compromising DTU profiles and using them to gain access to DTUBasen. This gave them access to personal data dating back to 2003.
The incident has been reported to the Danish Data Protection Agency and referred to the relevant authorities for further investigation. In parallel, DTU is investigating the course of events together with external specialists.
DTU cannot determine how many users have been affected by the attack, but DTUBasen contains information relating to approximately 40,000 active users and approximately 160,000 former users.