Within a few weeks, Denmark has seen two significant incidents involving personal data. At the Technical University of Denmark (DTU), attackers used compromised credentials to access DTUBasen, the university's identity and access management (IAM) system, and downloaded data relating to up to 200,000 current and former users. In a separate case, an unauthorized party misused a private company's legitimate search access to the Central Person Register (CPR), reaching names, addresses and CPR numbers for approximately 8.8 million registered individuals.
The two incidents differ in scale and in method. Yet both raise the same question: what happens next? A data breach is rarely only about the records that were taken. It is about what those records make possible afterwards.
The DTU Breach: Two Decades of Records Behind One Login
The DTU breach began with compromised credentials. How the attackers obtained them has not been confirmed, and credential stuffing and phishing are among the possible routes. Once authenticated, they had access to DTUBasen, the system that holds identity data for staff, students and alumni.
What they found there spanned more than twenty years. Nearly 40,000 active users and around 160,000 former users may be affected. The exposed information includes CPR numbers, full names, home addresses, profile pictures, work details and next of kin information. In MITRE ATT&CK terms, the attack maps to Valid Accounts (T1078) for initial access, Data from Information Repositories (T1213) for collection and Exfiltration Over C2 Channel (T1041) for the final step.
Several technical gaps may have made this possible. First, it is not yet known which authentication controls protected DTUBasen. If valid credentials alone were enough to reach a repository of this sensitivity, the absence of a second factor or step-up verification would be a significant weakness. Second, the attackers were likely able to escalate privileges and move across user databases, which suggests weak segmentation within the IAM environment. Third, large volumes of data left the system before anyone noticed. This points to limited monitoring of bulk queries and outbound traffic.
There is also a quieter issue. Around 80 percent of the affected records belong to people who no longer have any relationship with the university. Data retention, in other words, multiplied the impact of the breach fivefold.
The CPR incident: The Access Was Legitimate
The CPR incident followed a different path. Under the Danish CPR Act, companies with a legitimate interest may look up information on individuals. One such company held valid search access to the register, and unidentified parties misused that access to run unauthorized searches during September. The CPR administration spotted irregular activity on the evening of 2 October, confirmed the unauthorized access over the weekend and cut the company off.
The scale is striking. The register contains records on about 11 million people, including those who have died or emigrated, which explains why 8.8 million affected records exceeds Denmark's population of roughly six million. Names, addresses and CPR numbers were exposed. People registered for name and address protection were not affected, a small but telling sign that some controls held.
Based on what is known so far, no vulnerability was exploited and no password was guessed. The system did what it was designed to do: answer queries from an authorized party. That is precisely the problem. Authentication confirmed who was connecting, but nothing adequately checked whether the volume and pattern of searches matched a legitimate business purpose. The anomaly was eventually detected, but only after weeks of activity.
The CPR number sits at the heart of Denmark's highly digitized public sector. Every resident relies on it to deal with government agencies, banks and healthcare providers. When it is exposed together with a name and address, the damage is not limited to one register.
Context Is the Real Prize
Names, addresses, CPR numbers, employer details and next of kin create something more valuable than any single field: context. Context makes phishing more convincing. It strengthens social engineering. It can be combined with data from other breaches or public sources to build a detailed profile of an individual or an organization.
Artificial Intelligence (AI) amplifies this. Large language models (LLMs) can process large datasets, connect data points and write personalized messages in fluent Danish at scale. An email that mentions your former department at DTU, your home address and the name of your next of kin is far harder to dismiss. The minister has urged citizens to be vigilant about suspicious calls and emails. Vigilance, however, cannot carry the burden alone.
Lessons Learned for Cybersecurity and IAM
Both incidents point to lessons that go well beyond General Data Protection Regulation (GDPR) compliance or individual caution.
Protect the identity system as critical infrastructure - An IAM platform grants access to everything else. It deserves phishing-resistant multifactor authentication (MFA), privileged access management (PAM) for administrative functions and conditional access policies, in line with GDPR Article 32 and NIS2 Article 21.
Treat data retention as an identity governance decision - Former users should be deprovisioned, and their data minimized or deleted once its purpose has expired. Data that no longer exists cannot be exfiltrated.
Monitor behavior, not only authentication - Valid credentials and legitimate access say nothing about intent. User and entity behavior analytics, query rate limits and alerts on bulk exports would shorten the window between abuse and detection.
Govern third-party access continuously - The CPR company passed the initial test of legitimate interest. What matters is whether its use stays within that purpose over time. Purpose-bound entitlements, periodic access reviews and contractual audit rights belong in every arrangement where external parties query sensitive registers.
Prepare for non-human identities (NHIs) - As organizations give suppliers, systems and AI agents access to their data, the CPR case offers a clear warning. Access granted for one purpose can quietly be used for another.
The question Denmark now faces is not only who was behind these breaches. It is how many other legitimate doors remain open without anyone watching how they are used.
