Cyberattack exposes 52,000 LMU Munich students' financial and health data
Germany's largest university confirms attacker accessed enrollment records with bank details and health insurance numbers; no evidence of publication yet.
What to know
- An unknown attacker accessed LMU Munich's enrollment system, potentially exposing financial, health insurance, and personal data for over 52,000 students.
- The university confirmed the breach on Saturday after detecting it Wednesday but has not determined when access began, how long it lasted, or identified the attacker.
- No evidence yet that stolen data has been published or misused, and the university has not disclosed a ransom demand—suggesting this may not be a typical ransomware attack.
- LMU has extended enrollment deadlines and is working with law enforcement and external cybersecurity specialists while monitoring dark-web forums for signs the data is circulating.
The university's security posture was inadequate; the advice to students is hollow given the institution's failure to protect data in the first place.
-
“The LMU's advice for those affected to 'not disclose bank details or passwords' reads almost like a mockery. However, this decision has likely already been taken away from the students by the informant, as the university apparently did not…”
Heise Online · Heise Online ↗
The stolen data poses concrete risks for phishing and identity fraud, as criminals now have comprehensive personal and educational background information to exploit.
-
“Criminals, knowing about a person's educational background, can quickly gain the trust of their potential victims or use the master data to commit identity fraud for all kinds of transactions.”
Heise Online · Heise Online ↗
Ludwig Maximilian University of Munich (LMU) Victim institutionUnknown hacker/attacker PerpetratorBavarian State Criminal Police Office Investigating authority
How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts
-
2
Bavarian State Criminal Police Office launches investigation
Bavarian Broadcasting reported that the Bavarian State Criminal Police Office is investigating the incident. LMU is working with law enforcement on the investigation.
“Currently, we must assume that this data were in fact retrieved.”
— LMU Munich, Institution statement · source -
A
The Record: Cyberattack hits University of Munich, potentially exposing student financial data https:// therecord.media/cyberattack-hi ts-university-of-munich-potentially-exposing-data @ therecord_media # infosec # cyberattack # databreach
-
-
1
University extends enrollment deadlines; students report access problems
LMU suspended enrollment briefly but said it is expected to resume this week, with affected deadlines extended so students would not be disadvantaged. Some students reported problems accessing university services, with one telling Rosenheim24, 'I can't register for courses, I can't view my grades.'
“I can't register for courses, I can't view my grades.”
— LMU student -
first by The Record, 2d ago
-
Cyberattack on LMU Munich: student data leaked https://www. heise.de/en/news/Cyberattack-o n-LMU-Munich-student-data-leaked-11459356.html?utm_source=flipboard&utm_medium=activitypub Posted into heise online international @ heise-online-international-heiseonline
-
-
background
LMU publicly discloses breach; no ransom demand identified — On Saturday, LMU confirmed the cyberattack in a public statement, noting that the attacker has not been identified and the university has not disclosed whether it received a ransom demand. The university stated there is no evidence the stolen data has been published or misused. It is monitoring dark-web forums for signs the compromised information is being circulated.
-
background
LMU detects the cyberattack on Wednesday — The university discovered the incident on Wednesday, September 18, but has not yet determined when unauthorized access began or how long it lasted.
-
background
LMU disconnects affected servers, engages external specialists — After discovering the breach, the university disconnected the affected server and brought in external cybersecurity specialists. Several systems not directly affected were also shut down as a precaution, temporarily disrupting some internal services.
-
background
LMU confirms 52,000+ students potentially affected — LMU, one of Germany's largest universities with over 52,000 enrolled students, stated it must assume the sensitive data were retrieved by the attacker. Examination records, course content, and individual academic performance were not affected.
-
background
Potentially exposed data includes names, bank details, health insurance numbers — The compromised records include students' names, dates of birth, contact details, LMU email addresses, bank account information (IBAN and account holder), BAföG identifiers, health insurance numbers, course details, educational qualifications, and in some cases reasons for leaves of absence.
-
background
LMU Munich system breached; unauthorized access begins — An unknown attacker accessed one of LMU's IT systems containing enrollment data. The university has not determined when the unauthorized access began or how long it lasted.