Unknown attackers broke into a portal at the Technical University of Munich (TUM) and stole the central login passwords of everyone registered there, then used a system administrator's credentials to attack the university's central campus management system. The university disclosed the incident on 6 November 2026 and took the affected system offline.

According to TUM's statement, updated at 12:20 on Friday 6 November, the attackers first hit the myTUM portal. In doing so they stole passwords for the central login to TUM systems, including login.tum.de and TUMonline, from everyone who had registered with myTUM. Among the stolen credentials was the login of a system administrator for TUMonline. The attackers used those credentials to launch an attack on the campus management system, and the university subsequently took it offline.

What data was exposed

TUM says the attackers may have gained access to the account password, name, home address and date of birth of everyone affected. For employees, work addresses and work phone numbers may also have been exposed. For students, student ID numbers, degree programmes and the number of semesters completed may also have been accessed, where that information exists. The university has not said how many people are affected.

Access inside TUMonline was largely logged, and after analysing those logs the university currently assumes that no other data from the system was compromised, such as grades or college applications. It says the investigation is continuing. The university immediately suspended the affected accounts, reported the incident to the Bavarian State Commissioner for Data Protection and filed a criminal complaint.

Systems back online

Password changes were re-enabled on the morning of Monday 9 November, and by that evening TUMonline was back up and running. Before logging in, users must first change their password as a precaution and set up two-factor authentication. The university says accounts already protected by two-factor authentication were not affected. Reports say the ageing myTUM portal, which the attackers entered through, will remain offline permanently.

The breach matters beyond the two systems named, because the same central password is used across TUM's services, including TUMonline, the Moodle learning platform, the eduroam Wi-Fi network and the TUM email account. Anyone who used the same password on other services should change it there too.

What users should do

Affected students and staff should follow the password-change instructions on the university's IT pages, set up two-factor authentication, and watch out for phishing emails that exploit the breach. The university has not identified who is behind the attack, and it has not said when the attack began. German universities have been hit repeatedly in recent months, with ten higher-education targets reported since mid-September, including LMU Munich, Mannheim, Bremen, HU Berlin, Leipzig and the Charité hospital in Berlin.