The Technical University of Munich main building on Arcisstraße, Munich. Image: Wikimedia Commons, CC BY-SA 3.0.
📌 Key Highlights
- Unknown attackers hit TUM's myTUM portal and stole central-login passwords from everyone registered there, the university confirmed on 6 November 2026.
- The stolen credentials included a TUMonline administrator's login. The attackers used it against the campus management system, and TUM took TUMonline offline. UPDATE: TUMonline was restored on Monday 9 November at 7:00 AM CET.
- Data possibly accessed: account password, name, home address and date of birth for everyone affected — plus work address and phone for employees, and student ID, degree programme and semesters for students.
- TUM's current reading of its logs: no other TUMonline data, such as grades or applications, was taken — but the investigation is still running.
- What to do: change your TUM password now — password changes in TUMonline were re-enabled on Monday 9 November at 7:00 AM CET — then switch on multi-factor authentication — TUM says MFA-protected accounts were not affected.
What happened?
The Technical University of Munich (TUM) published an IT security notice on Friday 6 November 2026 and updated it on Monday 9 November at 7:00 a.m. CET, confirming that unknown attackers had broken into its myTUM portal. In the process, they stole the passwords for the central login to TUM systems — the same login used at login.tum.de and for TUMonline — from everyone who had registered with myTUM. German tech outlet heise reported that the attackers got in through an ageing legacy myTUM system.
The break-in escalated fast. Among the stolen credentials was the login of a system administrator for TUMonline, the central campus management system where grades and admission applications live. The attackers used it to attack TUMonline itself. TUM suspended the affected accounts, took TUMonline offline, reported the incident to the Bavarian State Commissioner for Data Protection and filed a criminal complaint — and says it has prevented the attack from spreading further.
TUM has not said when the attack began or who is behind it, and it has published no total number of affected people. German outlet heise reported that data of more than 60,000 people was involved, but TUM has confirmed no figure, so treat that number as reported, not official.
Technical University of Munich hack explained: what data was taken
TUM's notice lists what the attackers may have gained access to, and the list depends on who you are. The password matters most, because the same central login opens several TUM services — including the Moodle course platform, the eduroam Wi-Fi network and the university email account, according to TUM's IT guidance.
| Who is affected | Data the attackers may have accessed |
|---|---|
| Everyone registered on myTUM | TUM account password, name, home address, date of birth |
| Employees, additionally | Work address, work phone number |
| Students, additionally | Student ID number, degree programme, number of semesters completed |
Access inside TUMonline was largely logged, and from those logs the university currently assumes no other TUMonline data was compromised — grades and applications are the examples it names. That is a current assumption, not a final finding: the investigation continues, and TUM will update its notice as it learns more.
The Technical University of Munich campus. Image: Wikimedia Commons, CC BY-SA 3.0.
Why it matters for readers
The TUM hack is a textbook case of two weaknesses combining. The first is a single sign-on: one password opens everything, so stealing it once opens every door. The second is a privileged account: an administrator's login turns a data theft into a system compromise, which is exactly why TUMonline had to be switched off rather than simply patched.
The timing matters too. Password changes were impossible over the weekend while TUMonline was offline, leaving a weekend in which stolen passwords were live and the people holding them could not yet change them. That window closed on Monday morning, when TUM re-enabled password changes. That is also why the phishing warning in TUM's notice is worth taking seriously: with names, degree programmes and home addresses in attackers' hands, a fake "reset your TUM password" email can look convincingly personal. TUM says it will never ask for your password by email, phone or letter.
It also lands in a week full of credential failures: days earlier, an OpenSSH password bypass on Alpine Linux needed an emergency patch, and a SonicWall SSL-VPN flaw that bypassed MFA joined CISA's exploited list. For readers in India, the lesson is not about Munich: TUM is a major destination for international students, and the same one-login-for-everything pattern exists in universities and workplaces everywhere, including in India.
Should you care?
What to do now
If you have a TUM account, the steps are the university's own, in order. First, change your TUM password now — TUM re-enabled password changes in TUMonline on Monday 9 November at 7:00 AM CET, and its IT news page now lists three ways to do it: Microsoft 365 (recommended), a German online ID card, or a reset email on the campus network. Everyone with a TUM ID must change their password, even if you never used myTUM; a password changed since 5 November 2026, 00:00 stays valid. Second, enable multi-factor authentication once the password is changed; TUM says accounts with MFA were protected from this attack. Third, if you have used your TUM password for other services outside TUM — a personal email account, an online store, social media — change it there as well, and use a unique password for each service from now on.
Fourth, treat unexpected messages with suspicion. Fraudsters could use your name, degree programme and address to write messages that look credible, so do not click links in suspicious emails and never hand over a password. TUM asks anyone who receives such a message to report it to it-sicherheit@tum.de. Reused passwords are the quiet multiplier: 2,539 passwords and keys were recently found exposed on GitHub in a separate incident, and every one of them becomes more dangerous the moment it is reused somewhere else.
FAQs
What happened in the Technical University of Munich hack?
Unknown attackers broke into TUM's myTUM portal and stole the central-login passwords of everyone registered there, plus names, home addresses and dates of birth. They then used a stolen TUMonline administrator login to attack the campus management system, which TUM took offline (since restored on Monday 9 November).
Is TUMonline down?
No — not anymore. TUM temporarily deactivated TUMonline after the attack, but restored access on Monday 9 November at 7:00 AM CET and re-enabled password changes. TUM warns the service may be slow under heavy traffic. Affected accounts were suspended at the same time.
Do I need to change my TUM password?
Yes — and you can do it now. Password changes in TUMonline were re-enabled on Monday 9 November at 7:00 AM CET, and TUM's IT news page now gives three routes: Microsoft 365 (recommended), a German online ID card, or a reset email on the campus network. Everyone with a TUM ID must change their password, even if you never used myTUM; a password changed since 5 November 2026, 00:00 stays valid. After changing it, enable multi-factor authentication. TUM says accounts with MFA were protected.
Was student data stolen in the TUM hack?
Passwords, names, home addresses and dates of birth may have been accessed, and students may also have had their student ID, degree programme and semesters exposed. TUM currently assumes grades and applications were not taken, based on its logs — but the investigation is ongoing.
Takeaway: One legacy portal, one shared password and one stolen admin login were enough to take a major university's campus system offline. The fix is unglamorous and it works: a fresh, unique password plus MFA.
Password changes are open now in TUMonline — change yours today using one of the three routes on TUM's IT news page (Microsoft 365 first, then eID, then a campus-network email). If your TUM password doubles as your email or banking password anywhere, change that one first.
Sources
- Technical University of Munich — IT Security Incident at TUM (official notice, 6 November 2026, updated 9 November 2026, 7:00 AM CET)
- The Register — Portal breach at Germany's top university exposes every registered user's password (9 November 2026)
- TUM IT — Password reset information (current news page)
- B2B Cyber Security — Technical University of Munich (TUM) hacked and data stolen (8 November 2026)
- Nexus Web Security — TUM Data Breach: 7 Critical Facts and Steps to Stay Safe (8 November 2026)
Comments
Post a Comment