According to the university, the intruders compromised the identity and access management infrastructure, which handles authentication and authorization across its systems, and proceeded to download a substantial amount of information. The exact scope of the exposed data and the total number of confirmed victims are still being assessed, with the figure of 200,000 representing the upper estimate of potentially affected users.

Key points so far:

• Affected organization: DTU (Technical University of Denmark)
• Compromised system: identity and access management platform
• Data involved: personal information of up to 200,000 users
• Attack type: unauthorized access followed by bulk data download

DTU has not publicly attributed the incident to a specific threat actor, and no ransomware group has been confirmed as responsible at this stage. Investigations into how the attackers obtained access and what data was taken are ongoing.

Anyone who may have an account tied to DTU's systems should watch for follow-up communications from the university and remain alert to phishing attempts that reference the breach.

Source: Unknown

If your organization relies on a centralized identity provider, have you reviewed its access logs and segmentation recently?