Portal breach at Germany's top university exposes every registered user's password
Stolen sysadmin credentials enabled a follow-on attack on the campus management system
A data breach at Germany's Technical University of Munich (TUM) has exposed the passwords of all users on the university's myTUM portal. The vulnerability, discovered on November 6, allowed attackers to gain access to the university's central login information, including an admin account. This enabled them to carry out a second attack on TUMonline, the university's main campus management system, which was consequently taken offline.
TUM confirmed on November 7 that the breach had occurred and that user accounts with multi-factor authentication (MFA) remained secure. The stolen passwords may have also provided access to users' personal data, such as names, addresses, and birthdates. The affected users include 51,954 students and 12,850 staff members across TUM's German and Singapore campuses.
TUM is advising users to reset their passwords via Microsoft 365 or use a German electronic ID if they do not have MFA enabled. The university is urging users to watch out for phishing attempts and to change any reused passwords.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
