Technical University of Munich data breach exposes TUM passwords

Attackers broke into the myTUM portal of the Technical University of Munich (TUM) and stole the passwords for the university's central login of everyone registered with it, then used one of them, a TUMonline system administrator's, to attack the university's campus management system. TUM disclosed the incident on Friday and has taken TUMonline offline.

The stolen passwords work for TUM's central login, which covers login.tum.de, TUMonline and other university systems. TUM says user accounts protected by multi-factor authentication were protected from the attack. It has suspended the affected accounts, reported the incident to the Bavarian State Commissioner for Data Protection and filed a criminal complaint.

What was taken

For everyone affected, the attackers may have obtained the TUM account password, name, home address and date of birth, according to the university. For staff they may also have work addresses and work phone numbers; for students, where applicable, student ID numbers, degree programmes and the number of semesters completed.

The attackers' activity inside TUMonline was "largely logged", TUM says, and its analysis of those logs suggests no other TUMonline data, such as grades or college applications, was compromised. It says it is still investigating.

What is not known

TUM has not said how the attackers got into myTUM, how many people had registered with it, or in what form the passwords were stored. It has not said who is behind the attack or whether anyone has claimed it. The university's notice says only that it was carried out by "unknown individuals" and that the spread of the attack was stopped.

What TUM users should do

TUM says it will give staff and students options to change their TUM password by Monday, with instructions on its IT news page, and asks them to switch on multi-factor authentication afterwards. Anyone who used their TUM password elsewhere, such as for a personal email account, online shops or social media, should change it there too.

The university also warns that fraudsters could use names, degree programmes and addresses to write convincing messages, and says it will never ask for a password by email, phone or letter. Suspicious messages should be reported to TUM's IT security team; questions about the incident go to its data protection office.

TUM says the notice will be updated as its investigation continues.