{"id":"CMP-202611-dyo5ii","kind":"campaign","aliases":[],"related":[],"title":"Technical University of Munich (TUM) breached: attackers stole myTUM login passwords, an admin login and personal data of students and staff; TUMonline offline","description":null,"summary":"TUM disclosed on 6 Nov 2026 that unknown attackers broke into the myTUM portal and stole the central TUM login passwords (login.tum.de, TUMonline and other TUM systems) of everyone registered with myTUM. Among them was a TUMonline system administrator's login, which the attackers used to attack the TUMonline campus management system; TUM took TUMonline offline and suspended affected accounts. Possibly exposed: TUM password, name, home address and date of birth; for employees also work address and work phone; for students also student ID number, degree program and number of semesters. TUM says grades and applications appear not to be affected. Accounts with MFA were protected. Start date of the intrusion and attacker identity unknown. Expect targeted phishing letters, emails and calls posing as TUM using this data.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-06T14:02:09+00:00","products":[{"name":"TUMonline","fixed":[],"vendor":"Technical University of Munich"},{"name":"myTUM","fixed":[],"vendor":"Technical University of Munich"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"You have (or had) a TUM account registered with myTUM (student or employee). Treat as suspect any email, letter or phone call claiming to be TUM that asks for your password or has you click a link to log in; TUM says it will never ask for your password by email, phone or letter. Official updates only at tum.de press release and https://www.it.tum.de/en/it/news-1/. Check whether your TUM password is reused on any other service.","fix":"Change your TUM password using the options TUM provides (announced by Monday 9 Nov 2026), then turn on MFA for your TUM account. Change the password anywhere else you reused it (personal email, shops, social media). Do not click links in messages claiming to be TUM; report them to it-sicherheit@tum.de. Questions: datenschutz-vorfall@tum.de. Organisations federating with or trusting TUM logins should treat TUM credentials as compromised.","status":"open","published_at":null,"first_seen_at":"2026-11-06T14:02:09+00:00","triaged_at":"2026-11-06T14:02:09+00:00","updated_at":"2026-11-06T14:02:14+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':25A '2026':38B '6':36B 'account':92B,134B 'address':99B,108B 'admin':13A 'administr':71B 'affect':91B,133B 'also':106B,114B 'among':65B 'appear':129B 'applic':128B 'attack':7A,41B,76B,79B,145B 'birth':103B 'breach':6A 'broke':42B 'call':154B 'campaign':29B 'campus':82B 'central':50B 'cmp':24A 'data':17A,160B 'date':101B,140B 'degre':118B 'disclos':34B 'dyo5ii':26A 'earli':31B 'early-warn':30B 'email':152B 'employe':105B 'everyon':61B 'expect':148B 'expos':94B 'grade':126B 'home':98B 'id':116B 'ident':146B 'intrus':143B 'letter':151B 'login':10A,14A,52B,73B 'login.tum.de':54B 'manag':83B 'mfa':136B 'munich':4A 'mytum':9A,28A,45B,64B 'name':97B 'nov':37B 'number':117B,121B 'offlin':23A,88B 'password':11A,53B,96B 'person':16A 'phish':150B 'phone':111B 'portal':46B 'pose':155B 'possibl':93B 'program':119B 'protect':138B 'regist':62B 'say':125B 'semest':123B 'staff':21A 'start':139B 'stole':8A,48B 'student':19A,113B,115B 'suspend':90B 'system':59B,70B,84B 'target':149B 'technic':1A 'took':86B 'tum':5A,33B,51B,58B,85B,95B,124B,157B 'tumonlin':22A,55B,69B,81B,87B 'tumonline':27A 'univers':2A 'unknown':40B,147B 'use':77B,158B 'warn':32B 'work':107B,110B","nicknames":["TUM breach"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["mytum","tumbreach","tumonline"],"ptokens":["mytum","tumonline"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"breach","search_a":"'-202611':25A 'admin':13A 'attack':7A 'breach':6A 'cmp':24A 'data':17A 'dyo5ii':26A 'login':10A,14A 'munich':4A 'mytum':9A,28A 'offlin':23A 'password':11A 'person':16A 'staff':21A 'stole':8A 'student':19A 'technic':1A 'tum':5A 'tumonlin':22A 'tumonline':27A 'univers':2A","search_b":"'2026':38B '6':36B 'account':92B,134B 'address':99B,108B 'administr':71B 'affect':91B,133B 'also':106B,114B 'among':65B 'appear':129B 'applic':128B 'attack':41B,76B,79B,145B 'birth':103B 'broke':42B 'call':154B 'campaign':29B 'campus':82B 'central':50B 'data':160B 'date':101B,140B 'degre':118B 'disclos':34B 'earli':31B 'early-warn':30B 'email':152B 'employe':105B 'everyon':61B 'expect':148B 'expos':94B 'grade':126B 'home':98B 'id':116B 'ident':146B 'intrus':143B 'letter':151B 'login':52B,73B 'login.tum.de':54B 'manag':83B 'mfa':136B 'mytum':45B,64B 'name':97B 'nov':37B 'number':117B,121B 'offlin':88B 'password':53B,96B 'phish':150B 'phone':111B 'portal':46B 'pose':155B 'possibl':93B 'program':119B 'protect':138B 'regist':62B 'say':125B 'semest':123B 'start':139B 'stole':48B 'student':113B,115B 'suspend':90B 'system':59B,70B,84B 'target':149B 'took':86B 'tum':33B,51B,58B,85B,95B,124B,157B 'tumonlin':55B,69B,81B,87B 'unknown':40B,147B 'use':77B,158B 'warn':32B 'work':107B,110B","search_c":"","first_public_at":"2026-11-06T11:16:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-dyo5ii","url":"https://www.tum.de/en/news-and-events/all-news/press-releases/details/it-security-incident-at-tum","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T14:02:09+00:00","fetched_at":"2026-11-06T14:02:09+00:00","note":null,"cites":["https://www.tum.de/en/news-and-events/all-news/press-releases/details/it-security-incident-at-tum"]}],"documents":[{"id":86812,"url":"https://www.tum.de/en/news-and-events/all-news/press-releases/details/it-security-incident-at-tum","title":"IT Security Incident at TUM","kind":"advisory","source":"analyst","publisher":null,"text":"TUM statement (status 6 Nov 2026 12:20): unknown attackers attacked the myTUM portal and stole central TUM login passwords (login.tum.de, TUMonline) of everyone registered with myTUM, including a TUMonline system administrator's credentials, then attacked TUMonline, which was taken offline. Possibly exposed: TUM account password, name, home address, date of birth; employees also work address and phone; students also student ID number, degree program, semester count. No evidence grades or applications were accessed. Accounts with MFA were protected. Affected accounts suspended. Users must change TUM password (options by Monday), enable MFA, change reused passwords elsewhere, beware phishing letters/calls/emails using their name, programme and address; TUM never asks for passwords. Report to it-sicherheit@tum.de; questions datenschutz-vorfall@tum.de.","published_at":"2026-11-06T11:16:05+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}