Short answer
Leipzig University said on 28 October 2026 that its IT systems were attacked and that it took its services completely offline to limit damage. In a statement on 2 November the rector said recovery will happen in stages and will take weeks. The university has not said who attacked it, what kind of attack it was, or whether data was accessed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Leipzig University (Universität Leipzig) |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Higher education |
| Country | Germany |
| Detected | 2026-10-28 |
| Disclosed | 2026-10-28 |
| People or records affected | University-wide IT services. No figure on people or data affected |
What data was exposed
- Not established. The university has not said whether any data was accessed or taken
What happened
On 28 October 2026, Leipzig University posted a notice that its IT systems had been attacked. To limit damage, it said, it took its services “completely offline” while analysis continued. The notice does not list which services were affected and does not say whether any data was involved.
What the rector said
In a statement dated 2 November, Rector Prof. Dr. Eva Inés Obergfell said the university’s crisis team was working around the clock with external IT incident response specialists. She said recovery would be gradual and prioritised, and that “we need to be prepared for it to take weeks before all our systems are back online.” She added that no IT system can ever be completely secure. The statement asks staff to brief external partners and advises against setting up parallel IT systems.
What users saw
t-online reported that the university website was unreachable and email was limited. From the end of the first week, faculties and central facilities could be reached through an external email system. Deadlines for written exam submissions were extended to 6 November. A replacement site runs at the usual web address, according to t-online.
What is not known
No source we read says who carried out the attack, whether it was ransomware, how the attackers got in, or whether data left the university. We list the data exposed as not established for that reason. We have seen no claim of responsibility. This post will go out of date as the university publishes more, so check its official notice.
Why scammers care even without a confirmed leak
A long outage means students and staff are waiting for messages about logins, exams and fees. That is the ideal setting for a fake “restore your account” email. Our guide on phishing messages shows how to check a sender and a link. If you have already typed your university login into a page you reached from a message, change the password at once and follow what to do after a data breach.
Related incidents
The Technical University of Munich also took systems offline in early November, which we cover in our TUM report. See all breach reports for more.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as the university IT service, saying your account is locked and asking you to log in through a link.
- Fake messages about exam registration, deadlines or fees that exploit the disruption.
- Calls or messages offering help restoring your account in exchange for your password or a code.
- Fake 'replacement portal' pages that copy the university login.
What to do if you are affected
- 01Get updates only from the official Leipzig University website and its Instagram account, which it names as its information channels. Type the address yourself.
- 02Do not enter your university login on any page you reached through an email or text, and expect that real staff will not ask for your password.
- 03If you reused your university password elsewhere, change it there and use a unique one for each account.
- 04Keep proof of any exam or application you submitted, since deadlines for written exam submissions were extended to 6 November.
- 05Report suspicious messages to the university's IT contact listed on its official site, not to a number in the message.
Frequently asked questions
Was student or staff data stolen at Leipzig University?
The university's notices and the t-online report do not say whether any data was accessed or stolen. The university has not published findings yet.
When did the attack happen?
The university's first notice was published on 28 October 2026 and says the attack happened that day. t-online dates it to the Wednesday before 2 November.
How long will the outage last?
In a statement on 2 November, Rector Eva Inés Obergfell said the university must be prepared for it to take weeks before all systems are back and running fully. Services will return step by step in order of priority.
What is working in the meantime?
According to t-online, the main website was unreachable and email was limited. Faculties and central facilities such as the University Library, the Sports Center and the Language Center could be reached through an external email system.
Do I need to change my password?
The university has not asked users to. Because the scope is unknown, change it if you reused it elsewhere, and be careful with any message that asks for your login.
Sources
- Angriff auf die IT-Systeme (Attack on the IT systems), Universität Leipzig, 2026-10-28
- Uni Leipzig nach IT-Angriff wohl wochenlang eingeschränkt (Leipzig University probably restricted for weeks after IT attack), t-online, 2026-11-02
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.