Short answer
The Technical University of Munich says unknown attackers breached its old myTUM portal, captured passwords entered there and used a TUMonline administrator login to reach the central campus system. About 60,000 people may be affected. TUM says grades and application data show no sign of access so far.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Technical University of Munich (TUM) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Higher education |
| Country | Germany |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-06 |
| People or records affected | About 60,000 students and staff (heise online, citing the university) |
What data was exposed
- TUM account passwords of people who logged in to the old myTUM portal
- Names, private addresses and dates of birth
- Work address and work phone number for employees
- Possibly matriculation number, course of study and number of semesters for students
What happened
On 6 November 2026 the Technical University of Munich (TUM) confirmed an IT security incident. According to TUM’s statement, unknown attackers breached the old myTUM portal and captured the passwords of people who logged in there, including the credentials of a TUMonline system administrator.
heise online reports that the attackers then used those administrator credentials against TUMonline, the central campus management system, and that TUM took its student platforms offline. A TUM spokesperson told heise that about 60,000 students and staff are affected.
What data may be involved
TUM lists a TUM account password, name, private address and date of birth for everyone affected. Employees may also have had a work address and work phone number exposed. For students the list adds a possible matriculation number, course of study and number of semesters.
The university says its log review so far suggests that other TUMonline data, such as grades, exam results, applications and bank details, was not reached. It stresses that this is still being checked, and it has not said what was actually copied.
What TUM says it did
Affected accounts were locked and TUMonline was deactivated, which TUM says stopped the attack from spreading. It reported the incident to the Bavarian State Commissioner for Data Protection and filed a criminal complaint. Accounts protected by multi-factor authentication were not affected, according to the university.
A TUM IT status notice says new multi-factor setup for the TUM login is not possible while the incident is open, and that EduVPN now requires multi-factor sign-in.
Open questions
The date of the intrusion is not settled. Borns IT- und Windows-Blog cites an internal message that refers to a security incident since 2 November, but TUM’s public statement does not give that date. No group has claimed the attack in the sources we read, and TUM has not said how many passwords were taken.
What this means for scams
Stolen names, addresses and study details let a scammer write a message that sounds like the university. Expect fake “account locked” emails and calls. Our guide to phishing messages shows how to check a sender, and what to do after a data breach lists the basic steps. If you reused your TUM password, change the others first, since attackers often try a leaked password on other services within days.
See our other breach reports for similar incidents.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails that look like TUM IT, saying your account is locked and asking you to log in through a link.
- Messages or letters that use your name, course of study or home address to sound genuine.
- Phone calls from someone claiming to be university IT who asks for a password or multi-factor code.
- Credential stuffing: attackers trying your TUM password on email, social media and shopping accounts.
What to do if you are affected
- 01Change your TUM password as soon as TUM opens password resets (TUM-IT names Monday 9 November), and set up multi-factor authentication.
- 02If you reused your TUM password anywhere else, change it there now and make each password unique.
- 03TUM says it will never ask for your password by email, phone or letter. Hang up or delete anything that does.
- 04Do not click links in messages about the incident. Open it.tum.de yourself and read the official notice.
- 05Report suspicious messages to it-sicherheit@tum.de, and report letters or calls that use your personal details to the police.
Frequently asked questions
Was my TUM password stolen?
TUM says the attackers captured passwords of everyone who logged in to the old myTUM portal. Whether your password was actually taken is still under review, so treat it as exposed and change it.
Were my grades or exam results accessed?
TUM says its log review so far suggests no other TUMonline data, such as grades or applications, was affected. It adds that checks are continuing.
Does multi-factor authentication protect me?
TUM says accounts with multi-factor authentication were protected in this attack. Setting it up is one of the university's main recommendations.
Did TUM report the incident to the authorities?
Yes. TUM says it informed the Bavarian State Commissioner for Data Protection and filed a criminal complaint.
Why can I not reset my password yet?
TUM says password resets and new multi-factor setup are impaired until the affected systems are fully restored. TUM-IT points to Monday 9 November for password changes.
Sources
- Plattformen offline: Cyberangriff auf TU München, heise online, 2026-11-06
- IT-Sicherheitsvorfall an der TUM, Technical University of Munich, 2026-11-06
- Sicherheitsvorfall TU-München (2.11.2026), Borns IT- und Windows-Blog, 2026-11-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.