Portal breach at Technical University of Munich exposes registered users' passwords

Attackers stole central university login passwords belonging to everyone registered with the Technical University of Munich's myTUM portal, including an administrator whose credentials were then used to attack a second system. TUM restored access to its TUMonline campus management system on Monday morning, allowing users to change their passwords. The university disclosed the attack on November 6.

How the attack unfolded

The initial attack targeted the myTUM portal, which serves students and faculty members and provides centralized online access to services and documents. TUM said attackers used the administrator's credentials to launch a follow-on attack on TUMonline, its central campus management system, which forced the IT team to take it offline. The university has not disclosed how attackers initially gained access or how the stolen passwords were stored, and it did not immediately answer questions about the number of affected users.

Data that may have been exposed

Attackers may also have accessed names, home addresses, and dates of birth. Potentially exposed employee records included work addresses and phone numbers, while student records included ID numbers, degree programs, and completed semesters. TUM confirmed that user accounts with multi-factor authentication (MFA) were protected from this attack, though it did not specify whether the affected administrator had MFA switched on.

Recovery and user guidance

TUM is directing users to reset their passwords through Microsoft 365 where possible. Those without MFA already configured must instead use a German electronic ID or request a reset email while connected to the campus network. The university also warned users to watch for phishing and fraud, and to change any passwords reused elsewhere.

Investigation and university scale

Dr Alexander Braun, CIO at TUM, said the attackers' access within TUMonline was largely logged and that, after analyzing those logs, the university currently assumes no other data from TUMonline was compromised, such as grades or college applications, while the investigation continues. TUM ranks first in Germany and 25th worldwide in the QS university rankings. The STEM-focused institution reports 51,954 students across its German campuses and TUM Asia in Singapore, plus 12,850 employees.

Sources: The Register