The Technical University of Munich (TUM) has disclosed that attackers stole the passwords of every user registered on its myTUM central portal, and used an administrator's credentials to launch a follow-on attack on its TUMonline campus management system, forcing the university to take the system offline. TUM restored access to TUMonline on Monday, allowing users to reset their passwords.
The breach, disclosed on November 6, affected the myTUM portal, which serves students and faculty as a central access point for services and documents. The university has not disclosed how the attackers initially gained access or how the stolen passwords were stored.
TUM, ranked first in Germany and 25th worldwide in the QS university rankings, is a STEM-focused institution with 51,954 students and 12,850 employees.
TUM confirmed that "user accounts with MFA were protected from this attack," but did not specify whether the admin had multi-factor authentication enabled. Potentially exposed data includes names, home addresses, dates of birth, and for employees work addresses and phone numbers; for students, ID numbers, degree programs, and completed semesters.
"The attackers' access within TUMonline was largely logged," said Dr Alexander Braun, CIO at TUM, in the disclosure. "After analyzing these logs, we currently assume that no other data from TUMonline was compromised, such as grades or college applications. We are continuing to investigate this."
TUM is directing users to reset passwords through Microsoft 365 where possible. Those without MFA already configured must use a German electronic ID or request a reset email while connected to the campus network. The university also warned users to watch for phishing and fraud, and to change any passwords reused elsewhere.
Analysis
Why This Matters
- The breach exposed the core credentials of every TUM user, increasing risk of account takeover and identity fraud.
- Given TUM's prominence, the incident highlights vulnerabilities in central authentication systems at major institutions.
- The attack underscores the importance of multi-factor authentication; accounts without MFA were left exposed.
Background
The Technical University of Munich is Germany's highest-ranked university and a leading STEM institution worldwide, with over 50,000 students and 12,000 employees. The breach targeted its myTUM portal and cascaded into the TUMonline campus management system. The university has not disclosed the attack vector or password storage method.
What to Watch
- Whether the attackers misuse the stolen passwords, particularly if users reuse them elsewhere.
- The outcome of TUM's ongoing investigation into whether additional data was accessed.
- Any changes to TUM's authentication policies, especially regarding mandatory MFA adoption.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe headline says passwords of all registered users were stolen in the TUM portal breach.www.theregister.com - Articles: “Attackers stole central university login passwords belonging to everyone registered with the Technical University of Munich's myTUM portal”
- SupportedThe summary says attackers used administrator credentials to attack TUMonline.www.theregister.com - Articles: “TUM said the attackers used the admin's credentials to launch a follow-on attack on TUMonline”
- SupportedAttackers stole the passwords of every user registered on myTUM.www.theregister.com - Articles: “Attackers stole central university login passwords belonging to everyone registered with the Technical University of Munich's myTUM portal”
- SupportedThe admin's credentials were used in a follow-on attack on TUMonline, forcing the university to take that system offline.www.theregister.com - Articles: “TUM said the attackers used the admin's credentials to launch a follow-on attack on TUMonline, its central campus management system, which forced the IT team to take it offline.”
- SupportedTUM restored access to TUMonline on Monday, allowing users to change their passwords.www.theregister.com - Articles: “TUM restored access to its TUMonline campus management system on Monday morning, allowing users to change their passwords.”
- SupportedThe university disclosed the attack on November 6.www.theregister.com - Articles: “The university disclosed the attack on November 6.”
- SupportedThe university has not disclosed how the attackers initially gained access or how the stolen passwords were stored.www.theregister.com - Articles: “The university has not disclosed how the attackers initially gained access or how the stolen passwords were stored.”
- SupportedTUM confirmed that “user accounts with MFA were protected from this attack.”www.theregister.com - Articles: “it confirmed that "user accounts with MFA were protected from this attack."”
- SupportedTUM did not specify whether the administrator had MFA enabled.www.theregister.com - Articles: “It also did not specify whether this sysadmin had multi-factor authentication (MFA) switched on”
- SupportedPotentially exposed information included names, home addresses and dates of birth; employee work addresses and phone numbers; and student ID numbers, degree programs and completed semesters.www.theregister.com - Articles: “Attackers may also have accessed names, home addresses, and dates of birth. Potentially exposed employee records included work addresses and phone numbers, while student records included ID numbers, degree programs, and completed semesters.”
- SupportedDr Alexander Braun said, “The attackers' access within TUMonline was largely logged.”www.theregister.com - Articles: “"The attackers' access within TUMonline was largely logged," said Dr Alexander Braun, CIO at TUM, in the disclosure.”
- SupportedDr Alexander Braun said TUM currently assumes no other TUMonline data, such as grades or college applications, was compromised after reviewing the logs.www.theregister.com - Articles: “"After analyzing these logs, we currently assume that no other data from TUMonline was compromised, such as grades or college applications. We are continuing to investigate this."”
