Portal breach at Germany's top university exposes every registered user's password

Stolen sysadmin credentials enabled a follow-on attack on the campus management system

Attackers stole central university login passwords belonging to everyone registered with the Technical University of Munich's myTUM portal, including an admin whose credentials were then used to attack a second system.

TUM restored access to its TUMonline campus management system on Monday morning, allowing users to change their passwords.

The university disclosed the attack on November 6. The initial attack targeted the myTUM portal, which serves students and faculty members, providing centralized online access to services and documents.

REG AD

TUM said the attackers used the admin's credentials to launch a follow-on attack on TUMonline, its central campus management system, which forced the IT team to take it offline.

REG AD

The university has not disclosed how the attackers initially gained access or how the stolen passwords were stored. It did not immediately answer questions about the number of affected users.

It also did not specify whether this sysadmin had multi-factor authentication (MFA) switched on, but it confirmed that "user accounts with MFA were protected from this attack."

Attackers may also have accessed names, home addresses, and dates of birth. Potentially exposed employee records included work addresses and phone numbers, while student records included ID numbers, degree programs, and completed semesters.

"The attackers' access within TUMonline was largely logged," said Dr Alexander Braun, CIO at TUM, in the disclosure. "After analyzing these logs, we currently assume that no other data from TUMonline was compromised, such as grades or college applications. We are continuing to investigate this."

TUM is directing users to reset their passwords through Microsoft 365 where possible. Those without MFA already configured must instead use a German electronic ID or request a reset email while connected to the campus network.

The university also warned users to watch for phishing and fraud, and to change any passwords reused elsewhere.

TUM ranks first in Germany and 25th worldwide in the QS university rankings. The STEM-focused institution reports 51,954 students across its German campuses and TUM Asia in Singapore, plus 12,850 employees. ®