A ransomware post naming natmus.dk points to a real public institution, but the technical facts remain thin: what is confirmed is a claim, not a proven breach.
A victim label on a ransomware extortion site is not proof of breach, but it is enough to trigger a serious security response for any heritage institution.