What the Danish university attacks mean for your organization

Olav Helland

November 6, 2026

Pixel illustration of two figures on a staircase, one gray at the bottom and one green at the top, showing a guest account climbing to admin rights.

On September 15, an attacker took over a guest account at the Technical University of Denmark (DTU). The account had no general rights. Three days later, the same attacker held extended admin rights in DTUBasen, DTU's own identity and access management system. That was enough to get past DTU's alarms.

We know this because DTU published its timeline in detail. That openness is rare, and it gives every other organization a chance to learn from it. Within weeks, the University of Copenhagen and Aarhus University reported attacks of their own. At Copenhagen, an attacker used a configuration error to get into a test environment holding data on about 525,000 people. At Aarhus, an attacker tried to change the passwords of about 1,700 users and failed. No link between the three has been documented.

Denmark is not alone. Since late 2025, Harvard and Instructure, the company behind the Canvas learning platform, have both disclosed breaches where the way in was a person or an account. At Harvard it began with a phone-based phishing attack. At Instructure, the actor used a free teacher account to exploit flaws in the platform.

Why are cyberattacks getting easier to run?

Finding a forgotten door used to take a skilled team and plenty of time. AI is changing that. In November 2025, Anthropic disclosed an espionage campaign against about 30 targets in which AI did 80 to 90 percent of the work. We have found no published report saying AI was used against the Danish universities. The trend is still clear: trying costs less every year.

Every leak also makes the next attack easier. In October, Denmark's Ministry of Science, Higher Education and Digital Affairs disclosed that someone had misused a private company's legitimate access to the national CPR register. They obtained names, addresses and CPR numbers, Denmark's personal ID numbers, for about 8.8 million registered people, including emigrated and deceased ones. Danish media later reported that the program behind it was built with AI. Details like these make a phishing email or call far more convincing. DTU now warns its users about messages and calls that seem to know about their DTU connection.

None of this is a reason to panic. It is a reason to stop treating security as something that happens to other people, and to build resilience on purpose.

Why are universities so exposed?

Universities are built to be open, so they collect accounts that should no longer work. A former student who can still sign in. A visiting researcher who left two years ago. An admin role someone needed once. A service account set up for an integration years ago. And now AI agents, created in minutes, often with no clear owner.

Thousands of people arrive and leave every semester, and guests, partners and research projects each come in by their own route. HR, faculties, research groups and IT each own a piece, and the gaps open at the handoffs. DTUBasen held data on about 160,000 former users next to 40,000 active ones. Four former users for every active one.

Every organization has some version of this. Cloud services and AI create identities faster than any team can track by hand, and in the environments we have seen, old identities pile up. The question for any leader is how big your gap is, and whether you can see it.

Why MFA alone does not close the door

Most leaders hear "we have MFA" and relax. DTU's timeline shows why that is not the whole answer. Along the way, the attacker captured the password of a new guest student and then set up MFA on that account. From that point, the second factor belonged to the attacker.

MFA protects an account only if you control who can add a sign-in method to it. If anyone with a password can register one, a stolen password becomes an account the attacker fully owns.

How can universities reduce the risk?

Shrink the attack surface: fewer doors an attacker can try, and less behind each one. You cannot stop every attempt. DTU's attacker also exploited vulnerabilities in DTUBasen, and good identity hygiene alone would not have closed those. What identity controls do is limit how far a stolen account gets. Four moves make the biggest difference.

Close the doors nobody uses. Accounts belonging to people who have left are easy to misuse and rarely noticed. Every account with no sign-in for a set period gets a decision: disable, delete, or keep with a written reason.
Remove power nobody needs. Admin rights that sit unused give nothing day to day and everything to an attacker. At DTU, extended admin rights were enough to get past the alarms. Remove the roles nobody uses, and grant the rest only when needed.
Decide who can add a sign-in method. Registering MFA should take more than a password: either being on a trusted network or a time-limited code from IT.
Give every identity an owner and an end date. Guests, partners and AI agents included. Faculties and research groups own their guests, because IT can't carry it alone. If nobody owns it, nobody notices when it is misused.

None of these are new ideas. The hard part is keeping them true every week, as people come and go and new tools get switched on.

If it has already happened

The technical steps belong to your IT team, and the box at the end lists them. A few decisions belong to leaders, and they go faster when they are made before an incident.

Who can order a reset for everyone? DTU forced a password change for its roughly 30,000 active users, with a deadline. Someone has to own that call.
Can you reach the people affected? When DTU needed to warn people, it could not reach everyone directly. It did not have CPR numbers for all students and staff, international ones for example, and had them for guests and partners only in a few cases. An owner or sponsor for every guest is also how you reach them in a crisis.
Who calls for help? Agree in advance who brings in outside help, such as your national or sector CERT and your incident response partner.

How do you keep this under control over time?

Bsure gives you an up-to-date view of the identities in your Microsoft Entra ID: accounts that can still sign in but haven't for months, standing admin rights, guests with no sponsor, and agents with no owner. Your team acts on facts instead of guesses, and you can see the gap shrink over time. Bsure is read-only. It shows you what to fix, and your team makes the change.

A good first step is the free Bsure Identity Health Check. It runs in your browser, and your tenant data stays there unless you choose to send Bsure a summary. Its 18 checks include inactive users still enabled, standing privileged access, guests with no sponsor, and whether security info registration is protected.

Run the free health check or book a demo.

For your IT team

The first 48 hours. These hold for any identity system, with notes for Microsoft Entra ID.

Disable and revoke. Disable affected accounts and revoke their sessions. In Entra, existing access tokens stay valid until they expire, usually 60 to 90 minutes, unless the app supports Continuous Access Evaluation.
Review MFA methods registered in the attack window. An attacker's own method survives a password reset.
Review new admin roles, new guests and new app consents from the same window. Each is a way back in.
Reset at scale if you can't rule out exposure.
Warn users about follow-up phishing, and tell them what you will never ask for.
Bring in your CERT or ISAC.

For how the four moves work in Microsoft Entra ID, see the Microsoft Learn links under Resources.

FAQ

What happened in the Danish university cyberattacks in 2026?

Three Danish universities reported cyberattacks within weeks of each other in fall 2026. At the Technical University of Denmark (DTU), an attacker went from a guest account to extended admin rights in DTU's own identity system in three days. At the University of Copenhagen, an attacker used a configuration error to reach a test environment holding data on about 525,000 people. At Aarhus University, an attacker tried to change the passwords of about 1,700 users and failed.

Why are universities so exposed to identity attacks?

Universities are built to be open, and thousands of people arrive and leave every semester. Accounts belonging to former students, visiting researchers, guests and old integrations often keep working long after anyone needs them. DTU's identity system held data on about 160,000 former users next to 40,000 active ones.

Does MFA stop attacks like the one at DTU?

MFA protects an account only if you control who can add a sign-in method to it. At DTU, the attacker captured a new guest student's password and then set up MFA on that account, so the second factor belonged to the attacker. Registering MFA should take more than a password, such as being on a trusted network or a time-limited code from IT.

How can an organization reduce its identity attack surface?

Four moves make the biggest difference. Disable or delete accounts with no sign-in for a set period, remove admin rights nobody uses, decide who can add a sign-in method, and give every identity an owner and an end date, including guests and AI agents. You can't stop every attempt, but these moves limit how far a stolen account gets.

What should IT do in the first 48 hours after an identity breach?

Disable affected accounts and revoke their sessions. Review MFA methods, admin roles, guests and app consents added during the attack window, since each one is a way back in. Reset passwords at scale if you can't rule out exposure, warn users about follow-up phishing, and bring in your CERT or ISAC.

How can I check my Microsoft Entra ID for these risks?

The free Bsure Identity Health Check runs 18 checks on your Microsoft Entra ID tenant, including inactive users still enabled, standing privileged access, guests with no sponsor, and whether security info registration is protected. It runs in your browser, and your tenant data stays there unless you choose to send Bsure a summary.