TUM myTUM breach: stolen passwords, service restrictions, and what users should do

TUM says attackers stole central-login passwords through myTUM, including a TUMonline administrator credential. Password resets are available, but service and MFA restrictions remain.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Laptop on a desk at night showing a generic university login screen, shield check, broken key, warning symbol and network icon.
AI-generated editorial illustration of a generic university login security incident; it is not an official TUM image or interface.

TUM myTUM breach: stolen passwords, service restrictions, and what users should do12

TUM says unknown attackers stole central-login passwords from everyone registered with myTUM, including a TUMonline system-administrator credential that was then used against TUMonline.1 The university took TUMonline offline and says its investigation is continuing.1

Confirmed incident • Reporting cutoff: November 7, 2026, 2:47:27 a.m. EST / 7:47:27 a.m. UTC7

The bottom line

Password changes are now available, but TUMonline login remains unavailable; users who have not changed their TUM password since November 5, 2026, at 12:00 a.m. must change it, and a new password will be required when TUMonline reopens.2 Service access still depends on previously configured MFA for some users.56

Verified facts

Potential personal dataTUM says possible access includes the TUM password, name, home address and date of birth; employee data may also include a work address and phone number, while student data may include a student ID, degree program and completed semesters.1
Containment and reportingTUM says it suspended affected accounts, temporarily deactivated TUMonline, notified the Bavarian State Commissioner for Data Protection and filed a criminal complaint.1
Current evidence boundaryTUM says its logs currently indicate no other TUMonline data such as grades or college applications was compromised, while the investigation continues.1

What happened

According to TUM, the attack began through the legacy myTUM portal, where central-login passwords were stolen from everyone registered there. One stolen credential belonged to a TUMonline system administrator, and TUM says the attackers used it against the campus-management system.1

Why it matters

The same central-login theft reached beyond the legacy portal: TUM says the stolen administrator credential was used against TUMonline, which it then took offline.1

Current service restrictions

Service Status at the reporting cutoff
TUMonline Login is still unavailable. Once access is restored, users can sign in only with a new password.2 The TUM status record identifies TUMonline and connected systems as affected, with an incident window from November 3, 2026, 2:55 a.m. to November 8, 2026, 3:55 a.m. EST.3
myTUM and connected services The portal and connected services are unavailable and will not be brought back into operation.4
Microsoft 365 Login is blocked for people who had not configured MFA before the restriction.6
EduVPN Access requires a previously configured passkey, or previously configured TOTP together with a valid TUM password. Initial MFA enrollment is currently unavailable, so EduVPN is limited to people who had already set up MFA through TUMonline and meet those conditions.5

What this means for readers

  • Use TUM’s official reset routes. TUM says to change the password through its listed methods, not through links in email, and to reject MFA prompts the user did not initiate.2
  • Replace reused passwords. TUM tells users who reused their TUM password on other services to change it there too and use a unique password for each service.1
  • Treat personal details as possible phishing material. TUM warns that names, degree programs and addresses could be used to make messages appear credible, and says it will not request a password by email, phone or letter.1

Practical guidance for small businesses

Local relevance — analysis: this incident concerns TUM in Munich; it is not a claim that a Treasure Coast organization was affected.1

  • Use unique passwords — direct guidance: TUM explicitly recommends a unique password for each service.1
  • Enroll MFA before an incident restricts access — bounded inference: TUM says MFA-protected accounts were protected in this attack, while current service restrictions prevent some new MFA enrollment.15
  • Separate everyday and privileged administrator accounts — bounded inference: this risk-reduction recommendation is inferred from TUM’s report that a stolen administrator credential was used against TUMonline; TUM’s notice does not itself prescribe account separation.1

What remains unknown

Possible access is not the same as confirmed exfiltration. TUM describes the listed personal data as information attackers may have accessed.1

The investigation is continuing, so the final confirmed data set and outcome are not established by the reviewed TUM notice.1

Sources

  1. IT Security Incident at TUM — Technical University of Munich, published November 6, 2026.
  2. Aktuelles / Informationen zum Passwort Reset — TUM IT, updated November 7, 2026, 07:54 CET.
  3. TUMonline and connected systems status — TUM IT disruption notifications.
  4. myTUM portal interruption — TUM IT disruption notifications.
  5. EduVPN requires MFA — TUM IT disruption notifications.
  6. Initial MFA setup currently unavailable — TUM IT disruption notifications.
  7. — exact reporting cutoff recorded in UTC and America/New_York time.

Update and correction note: This article is bounded to the reporting cutoff above; it does not predict restoration timing or the investigation’s final outcome.17

Browse Articles

Latest Articles