A Danish university's identity system was emptied, and its retention rule missed the one field that matters

By Eli - Published: 11 October 2026

Denmark has had a rough week with personal numbers. On 2 October the Technical University of Denmark, DTU, published a breach notice, and three days later the national CPR register exposure was announced (we wrote about that earlier). In the DTU case, attackers compromised DTU profiles, used them to get into DTUBasen, the university's identity and access management system, and downloaded a large amount of data.

What DTU has said

The system holds records for about 40,000 active users and about 160,000 former ones, going back to 2003, so up to 200,000 people may be affected: staff, students, guests and external partners. DTU says it has contained the attack, is working with outside specialists, has reported the incident to the Danish Data Protection Agency and cannot yet say exactly what was taken. For active users the possible exposure includes CPR number, name, home address, profile picture and work details, plus next-of-kin names and phone numbers where people had entered them. For former users DTU says addresses, pictures and next-of-kin details are wiped after six months, but CPR numbers and names stay. BleepingComputer reports the attacker used stolen credentials.

The retention clock that did not cover everything

The detail worth sitting with is the six-month rule. Someone at DTU thought about minimisation: addresses and relatives' contact details do not outlive the person's time at the university. That is good practice, and it measurably shrank the pile. But the national identifier and the name were left in place indefinitely, presumably because something downstream still needs to match a returning alumnus or a long-ago co-author. A permanent CPR number alongside a name is the part that lets someone open accounts or craft convincing scams, so the exemption covers the most valuable field. This is how retention policies usually fail: not by being absent, but by keeping the one column that matters.

Directory systems attract this kind of accretion. A system built to answer "who is this person and what may they open" slowly becomes the place where everything about a person is stored because it is already joined to everything else.

What to do with this in your own estate

• List every field in your identity directory and ask for each one which process needs it today. Remove or tokenise the rest.
• Check whether national identifiers, dates of birth or next-of-kin details are held for people who left years ago, and whether the deletion rule covers the identifier as well as the address.
• Put the directory's own administrative and bulk-export paths behind stronger authentication than ordinary sign-in, and alert on large reads by any single account.
• Test the alert. Have someone with a normal staff login try to export a few thousand records and see who is told.
• Decide in advance how you would reach people who have left, whose email address no longer works. DTU is notifying many through the Danish e-Boks system and is asking others to pass its notice on.

Affected individuals are advised to be wary of messages that quote DTU details, to change any reused password and to consider a credit alert on their CPR number. If you hold a directory like this and are unsure what is in it, we can help you find out: sales@halfteck.com.