The Technical University of Denmark says information belonging to up to 200,000 users may have been exposed. The access was to its identity and access management system, and BleepingComputer reports the attackers downloaded data from it.

"May have been exposed" and "downloaded" appear in the same disclosure. One is a hedge. The other is a verb.

The "up to" figure is a ceiling set by what the system contains. It is not a count of people whose records were taken, and the university has not said how close the two numbers are.

An identity and access management system is the directory that decides who a person is and what they are allowed to open. It is the file an intruder wants first, because every later move borrows its authority. A university runs one for students, staff and a long tail of people who touched the place once and never left the list.

The reporting available does not say how the attackers got in, how long they were inside, or what fields were taken. Those three answers decide whether 200,000 people need a password reset or something worse.

The control that matters here is narrow. A bulk read of the full user directory is an unusual event on any network, and an alert on that single action, routed to a person who answers it, is the check that turns a download into an interruption. Whether DTU had one is not in the disclosure.