Overview
- The university says the breach began through the outdated myTUM portal earlier this week and that attackers obtained user passwords and an administrator’s credentials to reach the central TUMonline system.
- About 60,000 current students and staff have data that may have been exposed, with names, addresses, birthdates, matriculation numbers and study information identified as at-risk while the full extent of any theft is still under investigation.
- TUM has taken myTUM and TUMonline offline, locked affected accounts, and will allow password resets from Monday November 9 while urging everyone to enable multi-factor authentication to secure accounts.
- The university has reported the incident to the Bavarian data protection authority and filed a criminal complaint, and it says identifying the perpetrators is considered unlikely at this stage.
- The attack highlights a wider risk to universities that run legacy systems, and TUM warns that stolen personal details can feed phishing and social-engineering scams that will affect students and staff during the service outage.