🔐TU Munich Breach Exposes Passwords for Every myTUM User Account

Change your TUM password and watch for phishing

Attackers broke into the Technical University of Munich's myTUM portal and exposed the password of every registered user. Then they used stolen sysadmin credentials to hit TUMonline, the campus management system, and IT had to pull it offline. Access came back Monday morning, so you can finally reset your password. If you're a student or staff member at TUM, this is a reset-everything situation. Accounts with MFA were protected, which is the one good detail here. Everyone else needs to reset through Microsoft 365 where possible, or use a German electronic ID, or request a reset email while on the campus network. Change any password you reused elsewhere, too, because phishing emails citing this breach are a safe bet. The exposure is ugly. Attackers may have seen names, home addresses, and dates of birth. Employee records could include work addresses and phone numbers. Student records include ID numbers, degree programs, and completed semesters. The university says most of the attackers' activity inside TUMonline was logged. It has not said how they got in or how the passwords were stored, and that's the part worth watching.