The Technical University of Denmark has disclosed that attackers used stolen login credentials to reach DTUBasen, its identity and access management system, and pulled records covering roughly two decades.

The number in the headlines is 200,000. It is worth being precise about what that is.

200,000 is the database, not the victims

DTUBasen holds around 40,000 active users and 160,000 former users. Two hundred thousand is the population of the system — everyone connected to DTU as employee, student, guest or partner since 2003.

DTU says it cannot establish precisely which information was downloaded or how many people were affected.

So the figure describes an upper bound on exposure, and it is being reported as a count of people whose data was stolen. The real number is somewhere between one and two hundred thousand, and the university does not know where.

That is not a criticism of DTU for saying so. Admitting the uncertainty is the correct thing to do and many organisations do not. It is a criticism of how the number then travels.

What is in it

For active users, the records may include Danish civil registration numbers, names, home addresses, work email addresses, job titles and next-of-kin details.

The CPR number is the part that does not age. We made this point about the compromise of Denmark's Central Person Register last week, and it applies again: a CPR number is issued once and carried for life. It underpins tax, healthcare and banking. A password can be reset and an address changes. This cannot be reissued because it was copied.

Two Danish incidents touching the same identifier in eight days is not a coincidence of bad luck. It is what happens when one number is the key to everything and is held by every institution a person has ever dealt with.

The next-of-kin detail deserves its own line. People listed there never had a relationship with DTU at all. They were recorded because someone else named them, and they are now in a dataset they could not have known about.

Identity management was the target

The system breached was not a student records database or a payroll system. It was the identity and access management platform — the thing that knows who everyone is and what they may reach.

An IAM system is attractive for the obvious reason that it aggregates. One query returns what would otherwise require breaking into a dozen systems. It is also attractive for a less obvious one: it is the system from which further access is granted, so a foothold there is worth more than the data it holds.

DTU says the intrusion has been contained. The entry was stolen credentials, which is the unglamorous answer in most of these cases and the one that no patch addresses.

Who gets told

This is where the story turns from an incident into a decision.

DTU is notifying current and former employees directly through e-Boks, the Danish digital mailbox that every resident has and that institutions can write to.

It has said it will not notify all current and former students whose civil registration numbers it holds. It is relying on public disclosure to reach them instead.

In practice that leaves 160,000 former users — people who studied there, some of them twenty years ago — to learn about this from the news, if they happen to see it. A person who left DTU in 2008 and has not thought about the university since has no reason to be reading about it now, and their CPR number is in the same dataset as everyone else's.

The mechanism to reach them exists. e-Boks is exactly the infrastructure for this, and the university is already using it for one group and not the other. Whatever the reasoning — cost, address accuracy, legal threshold — the outcome is that notification tracks the strength of the ongoing relationship rather than the sensitivity of the data.

The case has been reported to the Danish Data Protection Agency. Whether the notification approach satisfies the obligation is now a question for them.

What to do

  • If you have ever been at DTU since 2003, assume your details are in it. That includes people who were there briefly as guests or partners.
  • Treat unsolicited contact that already knows your CPR number as more suspicious, not less. That is precisely the material that makes a phishing call sound legitimate.
  • If you are listed as someone's next of kin anywhere, you cannot audit that and there is no action available to you. Worth knowing anyway.

What is not established

  • What was actually taken. DTU says it cannot determine this.
  • How the credentials were stolen.
  • Who did it, and whether the data has been sold or published.
  • Whether the earlier compromise of the national CPR register and this one are connected. Nothing published suggests they are.
  • Whether the Danish Data Protection Agency will require DTU to notify the students it has decided not to write to.