The Technical University of Munich has taken its central campus management system offline after attackers gained access through a legacy system and obtained credentials that carried them into the university's live administration platform.
A university spokesperson confirmed the incident to heise online. The entry point was myTUM, an older system holding passwords, names, private addresses, dates of birth, matriculation numbers, degree-programme information and the number of semesters each student had completed. Potentially affected are all myTUM accounts — roughly 60,000 students and staff.
According to the university, the attackers were not primarily interested in myTUM itself. They used the legacy system as a gateway and obtained the access data of a system administrator for TUMonline, the platform that handles applications, enrolment, course registration and examination administration. Those TUM credentials have since been blocked. "Based on our current understanding, we were able to prevent the attack from spreading further," the spokesperson said.
The university says sensitive data — grades, examination results, applications, bank details — did not leak as far as it can currently determine, and that it expects the damage to remain limited. Whether any data left myTUM at all is still under investigation.
TUMonline was taken offline to contain the incident and will be restored gradually over the coming days. Until then, password resets and multi-factor authentication enrolment are also affected. The university advises all users to change their passwords — possible from Monday, November 9 — and to protect accounts with MFA. Anyone who reused a TUM password elsewhere should change it there too; accounts protected with MFA were not exposed in the attack, according to the university's IT department. TUM also warns of phishing emails built from the stolen data.
The incident has been reported to the Bavarian state commissioner for data protection and a criminal complaint has been filed.
Munich's other major university is the most recent precedent. Details of a cyberattack on Ludwig Maximilian University became public in September; LMU also took affected systems offline, and 600,000 records of current and former students — a body of data reaching back roughly 50 years — were affected.
The part that generalises is the pattern. The compromised system was not the one holding the most valuable data, but the one with the shortest path to it. Legacy authentication infrastructure that predates MFA requirements is exactly the asset that survives longest and gets inspected least.
