---
id: "CMP-202611-dyo5ii"
page: "https://infrastack.ai/live/CMP-202611-dyo5ii"
kind: "campaign"
aliases: []
title: "Technical University of Munich (TUM) breached: attackers stole myTUM login passwords, an admin login and personal data of students and staff; TUMonline offline"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "TUMonline", "fixed": [], "vendor": "Technical University of Munich"}, {"name": "myTUM", "fixed": [], "vendor": "Technical University of Munich"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-06T14:02:09+00:00"
updated_at: "2026-11-06T14:02:14+00:00"
sources: [{"source": "analyst", "url": "https://www.tum.de/en/news-and-events/all-news/press-releases/details/it-security-incident-at-tum", "first_seen_at": "2026-11-06T14:02:09+00:00", "cites": ["https://www.tum.de/en/news-and-events/all-news/press-releases/details/it-security-incident-at-tum"]}]
exploit_sources: []
---

# TUM breach: Technical University of Munich (TUM) breached: attackers stole myTUM login passwords, an admin login and personal data of students and staff; TUMonline offline

Link for people: https://infrastack.ai/live/CMP-202611-dyo5ii (this .md is for agents)

TUM disclosed on 6 Nov 2026 that unknown attackers broke into the myTUM portal and stole the central TUM login passwords (login.tum.de, TUMonline and other TUM systems) of everyone registered with myTUM. Among them was a TUMonline system administrator's login, which the attackers used to attack the TUMonline campus management system; TUM took TUMonline offline and suspended affected accounts. Possibly exposed: TUM password, name, home address and date of birth; for employees also work address and work phone; for students also student ID number, degree program and number of semesters. TUM says grades and applications appear not to be affected. Accounts with MFA were protected. Start date of the intrusion and attacker identity unknown. Expect targeted phishing letters, emails and calls posing as TUM using this data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :TUMonline affected range not listed fixed no fixed version listed
- :myTUM affected range not listed fixed no fixed version listed

## How to check

You have (or had) a TUM account registered with myTUM (student or employee). Treat as suspect any email, letter or phone call claiming to be TUM that asks for your password or has you click a link to log in; TUM says it will never ask for your password by email, phone or letter. Official updates only at tum.de press release and https://www.it.tum.de/en/it/news-1/. Check whether your TUM password is reused on any other service.

## Fix

Change your TUM password using the options TUM provides (announced by Monday 9 Nov 2026), then turn on MFA for your TUM account. Change the password anywhere else you reused it (personal email, shops, social media). Do not click links in messages claiming to be TUM; report them to it-sicherheit@tum.de. Questions: datenschutz-vorfall@tum.de. Organisations federating with or trusting TUM logins should treat TUM credentials as compromised.

## Timeline

- 2026-11-06T14:02:09+00:00 analyst https://www.tum.de/en/news-and-events/all-news/press-releases/details/it-security-incident-at-tum

## Documents

- [describes] IT Security Incident at TUM https://www.tum.de/en/news-and-events/all-news/press-releases/details/it-security-incident-at-tum

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_