Portal breach at Germany's top university exposes every registered user's password
Attackers stole central university login passwords belonging to everyone registered with the Technical University of Munich's myTUM portal, including an admin whose credentials were then used to attack a second system.
Key points
- The university has not disclosed how the attackers initially gained access or how the stolen passwords were stored.
- The university also warned users to watch for phishing and fraud, and to change any passwords reused elsewhere.
- TUM said the attackers used the admin's credentials to launch a follow-on attack on TUMonline, its central campus management system, which forced the IT team to take it offline.
The initial attack targeted the myTUM portal, which serves students and faculty members, providing centralized online access to services and documents.
Additional details
- Potentially exposed employee records included work addresses and phone numbers, while student records included ID numbers, degree programs, and completed semesters.
- TUM ranks first in Germany and 25th worldwide in the QS university rankings.
- Those without MFA already configured must instead use a German electronic ID or request a reset email while connected to the campus network.
- "After analyzing these logs, we currently assume that no other data from TUMonline was compromised, such as grades or college applications.
- The STEM-focused institution reports 51,954 students across its German campuses and TUM Asia in Singapore, plus 12,850 employees.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.