TUM takes TUMonline offline after theft of portal passwords
Attackers stole the passwords of everyone registered on a Technical University of Munich (TUM) portal, along with names, home addresses and dates of birth. One stolen login belonged to an administrator of TUMonline, the student records system, and was used against it; TUM took it offline. TUM believes grades were not touched and that accounts with multi-factor login were safe.
What happened
Attackers stole the passwords of everyone registered on a Technical University of Munich (TUM) portal, along with names, home addresses and dates of birth. One stolen login belonged to a TUMonline administrator, the system that runs student records, and was used against it. TUM has taken TUMonline offline.
Why it matters
The breach covers students' ID numbers, degree programmes and staff work addresses and phone numbers, plus personal data of everyone registered on the portal. TUMonline is offline, halting the central student records service. TUM has not said how many people are affected, but believes grades were not touched.
What to do
Reset passwords for portal and TUMonline accounts and require multi-factor login on every account; MFA-protected accounts were safe. Review what the compromised administrator account accessed in TUMonline before restoring the system.
For the technical team
- Affected
- Portal da Universidade Técnica de Munique (TUM); TUMonline, sistema central de registros estudantis, tirado do ar após u · Technical University of Munich (TUM) portal; TUMonline, the system that runs student records.
- Exploitation
- Attack reported by @IntCyberDigest. TUM took TUMonline offline and believes grades were not touched.
- Fix
- No software fix cited. Mitigation in progress: TUMonline taken offline; accounts with multi-factor login were safe.
- Vector
- Password theft from a TUM portal; one stolen administrator login was used against TUMonline, the student records system. Accounts with multi-factor login were safe, per the source. The initial method used to steal the passwords is not described.
- More details
- Stolen data: passwords, names, home addresses, dates of birth, students' ID numbers, degree programmes, and staff work addresses and phone numbers. TUM has not said how many people are hit. First public report of the incident.
Timeline
First public report: passwords and personal data of all portal registrants stolen, with an administrator account used against TUMonline, now taken offline.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
