Technical University of Denmark

The Technical University of Denmark disclosed a breach affecting up to 200,000 people. The exposed data includes Danish civil registration numbers, names, home addresses, profile pictures, work email addresses, job titles, office locations and next of kin information.

The attacker and the entry method have not been established in public reporting at the time of writing. The timing is what makes this notable: it lands days after the national CPR register breach covered separately in this series, which means the same identifier was exposed twice in one week through two unrelated incidents.

CPR numbers, names, home addresses, profile pictures, work email addresses, job titles, office locations and next of kin information.

Next of kin is the field that should not be there at this scale. A university collects it for emergencies, which is legitimate, and it means the breach reaches people who have no relationship with the institution at all. Someone's parent or partner is now in a breach notification for an organisation they never attended or worked for.

Students, staff and researchers, plus the emergency contacts they nominated. For a research university the staff directory also maps who works on what, in which building, which is targeting data in a sector under sustained interest.

The CPR number is the durable harm, for the same reason as the national register entry: it is not reissued. A Dane in both breaches now has their national identifier circulating from two independent sources, and no mechanism exists to change it.

Holding this data is ordinary university administration. Identity numbers for payroll and enrolment, addresses for correspondence, next of kin for emergencies, photographs for access cards and directories. Each field has a clear owner and a clear purpose.

The assumption worth examining is that a directory system is low risk because its contents feel administrative. A staff directory joined to payroll identifiers and emergency contacts is a complete personal profile, assembled for convenience from sources that were never meant to sit together.

That these fields were joined. Individually, a job title is public, an office location is on a door, and a CPR number is in payroll. The breach is serious because one system held all of them against the same person.

Universities accumulate this through decades of integration work, each step defensible, with no single moment where somebody assesses the combined sensitivity of the result.

The up to 200,000 figure is itself a signal. A range rather than a number, days after disclosure, is what an organisation publishes when it is still establishing which records the affected systems contained.

No group has claimed it and no attribution appears in the available reporting. Public reporting has not linked it to the national CPR register incident, and this entry does not either.

Two Danish CPR exposures in one week is a coincidence of timing rather than evidence of a connection, and treating it as more than that would be speculation.

Separating the identifier from the directory. A staff listing needs a name, a title and a work address. It does not need a national identity number attached to the same record, and that join is where an administrative system became an identity theft dataset.

Second, reviewing the next of kin data. It is collected for an emergency that will never happen for the overwhelming majority of people on file, retained indefinitely, and exposes somebody who was never asked.