Threat watch / Breach
Technical University of Munich: myTUM portal attack exposes central login passwords
The Technical University of Munich (TUM) says unknown attackers hit its myTUM portal and stole passwords for the central login to TUM systems. With a TUMonline system administrator's credentials, they then attacked TUMonline, the campus management system, which TUM took offline. TUM disclosed the incident on November 6, 2026 and brought TUMonline back on November 9, with a password change and two-factor authentication required. It says accounts with MFA were protected. TUM has not said how the attackers first got in or how many people are affected.
- Sector
- Education
- Way in
- Not public yet
- Product or vendor
- TUMonline
- How it happened
- Not public yet Checked 10 Nov 2026
- What was stolen
- Passwords for the central TUM login, taken from the myTUM portal. The attackers may also have accessed names, home addresses and dates of birth, plus work addresses and phone numbers for employees, and student ID numbers, degree programs and completed semesters for students. TUM currently assumes no other TUMonline data, such as grades or applications, was compromised. It has not said how the passwords were stored.[1][2] Checked 10 Nov 2026
- Who was impacted
- Everyone registered with myTUM, employees and students. TUM has not given a number; it did not answer The Register's question on how many users are affected. Accounts with MFA were protected.[1][2] Checked 10 Nov 2026
- Threat actor
- Not attributed
Timeline
- TUM discloses an IT security incident: unknown attackers hit the myTUM portal and stole central login passwords, then used a TUMonline system administrator's credentials to attack TUMonline. TUM suspends affected accounts, takes TUMonline offline, reports the incident to the Bavarian data protection commissioner and files a criminal complaint. [1][2]
- TUMonline is back. Users must change their password and set up two-factor authentication before logging in. TUM's CIO says the university currently assumes "that no other data from TUMonline was compromised". No group has been named. [1][2]