Platforms Offline After Cyberattack On TUM 11515813

The Technical University of Munich (TUM) has shut down key online platforms for students following a cyberattack. An attacker gained access through a legacy system and potentially accessed data belonging to students and employees, a TUM spokesperson confirmed to heise online. Investigators are still determining whether any data was also stolen.

The data of more than 60,000 students and university employees is involved. It is still unclear at this point what, if anything, was actually stolen. The university currently believes the damage is limited. Shutting down the platforms initially contained the attack.

“Attackers managed to use the legacy myTUM system to access users’ passwords, names, private addresses and dates of birth, as well as student ID numbers, degree program information and the number of semesters each user had completed”, TUM said. All myTUM accounts are potentially affected, but it is still unclear whether any data was actually exfiltrated.

According to sources at the university, current findings indicate that the attackers were not interested in the data on myTUM. Instead, they used the old system as a point of entry into the current campus administration system. The attackers also obtained the login credentials of a system administrator for TUMonline, according to the university.

“The attackers used these credentials to target our central campus management system”, the spokesperson said. The stolen TUM credentials have since been disabled. “Based on what we know so far, we were able to prevent the attack from spreading further.” The university stressed that, according to current findings, no sensitive data such as grades, exam results, applications or bank account information had been exfiltrated.

TUM has set up an information page the incident where those affected can learn the latest measures. The Technical University of Munich reported the attack to the Bavarian State Commissioner for Data Protection and filed a criminal complaint.

The university says it is working to bring TUMonline back online gradually over the few days. Until then, password resets and MFA setup are also affected, according to TUM IT. It advises all users to change their passwords — a change will be possible starting Monday, Nov. 9, according to TUM IT — and secure their accounts with multifactor authentication. Anyone who uses their TUM password for other services should change it there, too. Accounts secured this way were protected from the attack. Those affected are also being warned possible phishing emails that could use the stolen data.

Universities such as TUM are considered attractive targets for cybercriminals. Details of a cyberattack on Ludwig Maximilian University of Munich (LMU) emerged in September. In that case, too, the university took the affected systems offline. The incident involved 600,000 records containing personal and enrollment data for current and former LMU students, dating back 50 years.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.