Global News | November 10, 2026

The TUM cyberattack exposed a serious weakness in the Technical University of Munich’s central authentication system after attackers stole university login passwords, including credentials belonging to a TUMonline system administrator. The incident forced the university to temporarily take its campus-management platform offline and raised concerns about the potential exposure of students’ and employees’ personal information.

The university disclosed the incident on November 6, 2026, explaining that attackers had targeted its myTUM portal. The stolen credentials were subsequently used to target TUMonline, which was restored on November 9. However, the investigation remained ongoing, and some connected services continued to experience disruption.

The attackers used those administrator credentials to target TUMonline. TUM subsequently took the platform offline as a containment measure. The university restored TUMonline on November 9, but its investigation remained ongoing, and some connected services were still experiencing disruption on November 10.

The incident raises concerns beyond the temporary interruption of university services. Potentially exposed information includes names, private addresses and dates of birth, alongside certain employee and student details. TUM has not announced a confirmed number of affected individuals or explained how the attackers initially gained access to myTUM.

1. How the TUM Cyberattack Began

According to the university’s disclosure, the attack targeted myTUM, a portal used by members of the university community. The attackers obtained passwords used for central authentication to TUM systems from everyone who had registered with the portal.

The stolen credentials were not limited to ordinary user accounts. TUM confirmed that the credentials included those of a system administrator for TUMonline. The attackers then used that account to launch an attack against the campus-management platform.

This sequence is significant because TUMonline is a central university service rather than an isolated website. It supports important administrative and academic processes. The compromise of an account with administrative privileges therefore created a risk that extended beyond the original myTUM portal.

TUM did not publicly identify the technical vulnerability or access method that allowed the attackers to compromise myTUM. It has also not disclosed whether the passwords were obtained through an application vulnerability, a configuration weakness, a compromised server, or another route. Those possibilities should not be treated as established facts.

The university’s public notice describes the theft of passwords and the subsequent use of an administrator’s credentials. It does not provide enough technical detail to reconstruct the attackers’ initial entry or determine precisely how long they had access.

2. Why the Administrator Credentials Mattered

The presence of a TUMonline administrator account among the stolen credentials made the incident more serious. Administrative accounts can have broader permissions than standard user accounts, depending on how an organisation configures its systems.

In this case, TUM explicitly said that attackers used the administrator’s credentials to target TUMonline. The university took the system offline after identifying the attack.

The incident illustrates the risks created when credentials for central authentication services are compromised. A password stolen from one portal may have consequences for other services if the same identity system grants access across an organisation.

Universities operate complex digital environments. Students and employees may use a common institutional identity to access academic records, administrative tools, email, learning platforms and other services. Central authentication simplifies access, but it also makes account protection and privilege management especially important.

The TUM incident does not establish that every connected service was accessed or compromised. It does, however, demonstrate that stolen central credentials can be used to target a second system when the compromised account has sufficient privileges.

3. What Information May Have Been Exposed?

TUM warned that attackers may have accessed personal information during the incident. The university’s disclosure identifies different categories of potentially affected information for students and employees.

For all affected individuals, the information potentially accessible included:

• TUM account passwords
• Names
• Private home addresses
• Dates of birth

For employees, the potentially affected information additionally included work addresses and work telephone numbers.

For students, the university identified possible exposure of student identification numbers, degree programmes and the number of completed semesters.

These details can be valuable to criminals even when financial information is not involved. Names, dates of birth, addresses and institutional details can help attackers construct convincing impersonation attempts. A fraudulent message that refers to a person’s actual university programme or employment information may appear more credible than a generic phishing email.

However, the university’s wording is important: these are categories that attackers may have been able to access. TUM has not publicly confirmed that every listed data item was extracted or misused. Nor has it provided a final accounting of the number of individuals whose information was affected.

The distinction between potential access and confirmed exfiltration should remain clear while the investigation continues.

4. Were Grades and University Applications Compromised?

One of the most important questions for students concerns academic records.

TUM said that access within TUMonline was largely logged. After reviewing those logs, the university stated that it currently assumes no other TUMonline data was compromised, including grades and university applications. It also said that the investigation was continuing.

This is a qualified assessment, not a final declaration that every academic record was unaffected. The university’s statement reflects its review of available logs and its current understanding of the attackers’ activity.

For students, the distinction matters. Potential exposure of identity and enrolment-related information is serious, but it is not the same as confirmed access to examination results, application documents or other academic records.

The university has not publicly disclosed a final forensic report or a complete account of every action performed using the stolen administrator credentials. Until further findings are published, the current assessment should be reported with its stated limitations.

5. TUM Takes Systems Offline and Restores Access

TUM said it immediately suspended affected accounts and temporarily deactivated TUMonline after identifying the attack. The university stated that, based on its knowledge at the time, these measures helped prevent the incident from spreading further.

Taking a critical platform offline can disrupt students, employees and administrative operations. However, temporarily disabling a system can also limit opportunities for attackers to continue using compromised access while defenders investigate.

The university subsequently worked to restore password-changing functionality and access to TUMonline. On November 9, TUM announced that the platform was operational again. Users were instructed to change their passwords before logging in and to configure two-factor authentication.

The restoration did not mean that every connected service had immediately returned to normal. TUM’s IT status information on November 10 continued to list restrictions affecting TUMonline and connected systems. It also identified a remaining issue involving the document-sealing interface of the TUM Trust Center.

The status information showed that recovery was taking place in stages. Users should therefore rely on the university’s current IT notices rather than assume that every dependent service was fully restored at the same time as TUMonline.

6. Password Resets and Multi-Factor Authentication

TUM instructed users to change their central university passwords and enable multi-factor authentication (MFA). Its IT guidance states that anyone who had not changed their TUM password since November 5, 2026, at 00:00 must do so before logging in to TUMonline.

The university provides several password-reset methods, including options involving Microsoft 365, a German electronic identity card, the TUM login system and email under specified network conditions. Users should follow the current instructions published through TUM’s official IT channels.

TUM also said that accounts with MFA were protected from this attack. That statement highlights the importance of an additional authentication factor: a stolen password alone may not be sufficient to access an account when an effective second factor is required.

Nevertheless, users who already had MFA enabled are still instructed to change their passwords. TUM’s guidance makes clear that MFA protection does not remove the need to follow the university’s password-reset instructions.

The university also advises people who reused their TUM password on services outside the institution to change those passwords as well. Reusing passwords can allow an attacker who obtains one credential to attempt access to unrelated accounts.

7. Phishing Risks and the Investigation Ahead

The potential exposure of personal and university-related information creates a further risk: targeted social engineering.

TUM warned that criminals could use names, degree programmes and addresses to create convincing messages. Such messages could arrive by email, letter or telephone. An attacker might impersonate university staff, refer to a student’s programme or claim that an account requires urgent action.

The university has stressed that it will never ask users for their passwords by email, telephone or letter. It advises people not to click links in suspicious messages and to report suspected phishing attempts through its official security channels.

TUM said it had reported the incident to the Bavarian State Commissioner for Data Protection and filed a criminal complaint. The university also said it was continuing its investigation and would provide further information when available.

Several important questions remain unanswered. The university has not publicly explained the initial compromise method, identified the attackers, confirmed the number of affected people or published a final assessment of data access. The extent of any information actually removed from systems also remains unclear.

The restoration of TUMonline is an important recovery milestone, but it does not close the investigation. The incident demonstrates how compromised credentials can turn a portal breach into a wider institutional security problem, particularly when privileged accounts are involved.

For universities and other organisations that depend on central identity systems, the case reinforces the importance of MFA, careful administrator-account protection, monitoring of privileged activity, and tested incident-response procedures.

Source note: This report draws on information published by the Technical University of Munich, its IT services and reporting by The Register. The university’s investigation remains ongoing, and potential data access should not be interpreted as confirmed data theft in every case.

NewsFlayer — Bringing You the Latest Cybersecurity News from Around the World.