Loading story…
The Technical University of Denmark (DTU) disclosed a personal-data breach after attackers used compromised user credentials to access DTUBasen, its identity and access management system, and download data. Up to approximately 200,000 current and former users may be affected, with records dating back to 2003. Potentially exposed information includes Danish civil registration (CPR) numbers, names, addresses, contact details, employment information, profile photographs, and registered next-of-kin details. DTU cannot determine precisely which records were downloaded or how many people were affected.
DTU said it contained the attack, engaged external specialists, notified the Danish Data Protection Authority, and referred the incident to relevant authorities for investigation. The university is notifying affected individuals where possible and using its public disclosure to reach people it cannot contact directly. It warned of identity theft and targeted phishing risks, advising affected users to practice password hygiene, remain alert to unsolicited communications, and consider placing a credit warning against their CPR number where appropriate.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
DTU issued a public notice warning that data belonging to approximately 40,000 active and 160,000 former users, including CPR numbers and personal details, may have been exposed. The university warned of identity fraud and targeted phishing risks and used the disclosure to reach people it could not contact directly.
DTU notified Datatilsynet, the Danish Data Protection Authority, of the personal-data breach. It also referred the matter to relevant authorities for further investigation.
DTU began investigating the incident with external specialists to establish the extent of the attack and its consequences.
DTU's IT incident-response team contained the attack against DTUBasen.
Attackers used compromised DTU user accounts to gain unauthorized access to DTUBasen, the university's identity and access management system, and download a large quantity of data. DTU could not determine precisely which information was taken or how many people were affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcecert.dk
Open sourcecomputerworld.dk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Denmark confirmed that unauthorized parties accessed Central Population Register (CPR) records belonging to approximately **8.8 million people**, exposing names, addresses and CPR numbers. Attackers misused an unnamed private Danish company’s authorized access during September. The initial entry method remains unknown, and authorities have not identified a specific vulnerability or threat group. Protected names and addresses were excluded from the unauthorized access, but officials did not confirm that other information belonging to those individuals was unaffected. CPR administrators detected unusual activity on October 2 and subsequently blocked the company’s access, engaged specialists and notified Denmark’s Data Protection Authority. Police are investigating, while Minister Christina Egelund requested a thorough review of CPR security; authorities said preventive measures were already underway. Officials warned residents that the exposed information could support convincing phishing attempts and expanded access to security guidance. The incident highlights the risk posed by third-party access to sensitive population data, even where that access was originally authorized.
Oct 8, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026
Hackers gained unauthorized access to an online code repository at the University of Sydney, resulting in the theft of historical files containing sensitive personal information. The breach, detected by the university's security team, exposed data belonging to over 27,000 individuals, including current and former staff, students, alumni, and a small number of supporters. The compromised data includes names, dates of birth, phone numbers, home addresses, job titles, and employment dates, primarily from records dating between 2010 and 2019. The university clarified that this incident is unrelated to other technical issues reported around the same time. Upon discovery, the university immediately blocked access to the affected system and notified relevant authorities, including the New South Wales Privacy Commissioner and the Australian Cyber Security Centre. Impacted individuals are being informed through personalized notifications, and a dedicated support service has been established to assist those affected. As of now, there is no evidence that the stolen data has been published or used for fraudulent purposes, but the university continues to monitor the situation and has launched a comprehensive investigation expected to continue into January 2026.
Jun 29, 2026