Short answer
DTU says a targeted attack on DTUBasen, its identity and access management system, let an attacker use compromised profiles to download a large amount of user data. DTU announced it on 2 October 2026 and says up to 200,000 current and former users may be affected, but it cannot say exactly what was taken.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Technical University of Denmark (DTU) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Higher education |
| Country | Denmark |
| Detected | 2026-10-02 |
| Disclosed | 2026-10-02 |
| People or records affected | Up to 200,000 current and former employees, students, guests and partners since 2003 |
What data was exposed
- Danish civil registration (CPR) numbers and full names
- Home addresses and profile pictures (active users)
- Work email, job title, office location and other employment details
- Next-of-kin names, relationships and phone numbers where registered
What happened
The Technical University of Denmark (DTU) announced on Friday 2 October 2026 that it had suffered a targeted cyberattack. According to DTU, the attacker compromised DTU profiles, used them to get into DTUBasen, the university’s identity and access management system, and downloaded a large amount of data. The incident response team contained the attack and DTU is investigating with outside specialists.
DTU says it cannot determine exactly what was downloaded or how many people are affected. It puts the possible total at up to 200,000, made up of about 40,000 active users and about 160,000 former users, with data going back to 2003. University Director Bjarke Bak Christensen called it “a serious attack” and said DTU regrets the uncertainty it causes, as reported by BleepingComputer.
What may have been taken
For active users, DTU lists the Danish civil registration (CPR) number, full name, home address, profile picture, work email address, job title, office location and other work details. For next of kin that active users registered, it lists name, relationship and phone number. Former users’ addresses, pictures and next-of-kin details are deleted automatically after six months, but their CPR numbers and full names remain in the system.
Notification
DTU says it will notify current and former employees personally through e-Boks, along with nearly all current and former students for whom it holds a CPR number. It holds CPR numbers for only a few guests and external partners and none for next of kin, so it published a public notice and asked people to share it. DTU reported the incident to the Danish Data Protection Agency.
Risks DTU highlights
DTU warns that the data could be used for identity fraud or to make phishing and other scams more convincing. People with name and address protection face added risk of unwanted contact or being located.
What to do
DTU’s advice is to treat unexpected emails, texts and calls with suspicion even when the sender seems to know your DTU connection, to refuse unexpected login requests, to change any password shared with other services and to consider a credit alert on your CPR number via Borger.dk.
The same week brought the CPR register incident, and three weeks later the University of Copenhagen breach. See our data breach checklist and the guide to phishing messages for what follows a leak like this.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails, texts or calls from people who seem to know your DTU connection, CPR number or next of kin.
- Fake login prompts or unexpected authentication requests that try to take over your accounts.
- Identity fraud using your CPR number, with extra risk of unwanted contact if you have name and address protection.
What to do if you are affected
- 01Watch for a personal notice in e-Boks if you were an employee or student, and read DTU's public notice if you were a guest or partner.
- 02Do not share passwords or confidential details in reply to unexpected emails, texts or calls, even if the sender knows your DTU history.
- 03Do not approve login or authentication requests you did not start.
- 04Change the password on any other service where you used your DTU password.
- 05Consider registering a credit alert against your CPR number at Borger.dk, and be extra careful if you have name and address protection.
Frequently asked questions
How did the attacker get in?
DTU says the attacker compromised DTU profiles and used them to log into DTUBasen. It has not said how the credentials were obtained, and BleepingComputer notes the article did not identify the attacker.
Who may be affected?
Anyone who has been an employee, student, guest or external partner at DTU since 2003. DTUBasen holds about 40,000 active users and about 160,000 former users.
What happens to data on former users?
DTU says home addresses, profile pictures and next-of-kin details are deleted automatically six months after a user leaves. CPR numbers and full names remain in DTUBasen.
How will DTU contact affected people?
Current and former employees and nearly all students with a CPR number on file will be told personally through e-Boks. DTU also published a public notice for guests, partners and next of kin it cannot reach directly.
Sources
- Cyberattack on DTU: notification of a personal data breach, Technical University of Denmark, 2026-10-02
- Danish university DTU breach exposes data of up to 200,000 people, BleepingComputer, 2026-10-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.