Cyberattack hits University of Munich, potentially exposing student financial data

Germany’s Ludwig Maximilian University of Munich is investigating a cyberattack in which an unknown hacker accessed a system containing sensitive student information, including potential health insurance and financial aid data.

The university, commonly known as LMU Munich, said Saturday that an attacker accessed enrollment data stored on one of its IT systems.

“Currently, we must assume that this data were in fact retrieved,” the university said, adding that the investigation into the incident is ongoing.

LMU, which has more than 52,000 students and is one of Germany’s largest universities, said there was no evidence that the affected data had been altered or deleted. It had also found no indication so far that the stolen information had been published or otherwise misused.

The potentially affected records include students’ names, dates of birth and other identifying information; contact details and LMU email addresses; bank account information; and details about students’ courses of study and previous educational qualifications.

Health insurance numbers and identifiers associated with Germany’s student financial aid program may also have been affected. In some cases, the compromised information could include data related to the reasons students requested leaves of absence, according to the university.

LMU said examination records, information about specific course content and students’ individual academic performance were not affected.

The university detected the incident on Wednesday but said it has not yet determined when the unauthorized access began or how long it lasted. It also has not disclosed how many people may be affected or the volume of data potentially obtained.

The attacker has not been identified, and the university has not said whether it received a ransom demand.

Systems taken offline

After discovering the breach, LMU disconnected the affected server and brought in external cybersecurity specialists, it said. It is also working with law enforcement on an investigation.

Several systems that were not directly affected were also shut down as a precaution, leaving some internal services temporarily unavailable.

The university said the attack had not disrupted teaching, although enrollment was briefly suspended and is expected to resume this week. LMU said affected enrollment deadlines would be extended so students would not be disadvantaged.

The university has also asked specialists to monitor dark-web forums and other relevant platforms for signs that the compromised information is being circulated.

Some students have reported problems accessing university services used to prepare for the coming semester.

“I can't register for courses, I can't view my grades,” one student told German regional news outlet Rosenheim24.

Universities have long been attractive targets for cybercriminals because their networks can contain large amounts of personal and financial information while serving sprawling populations of students, researchers and staff.

U.S. universities that have recently faced ransomware attacks include the University of Texas, the University of Oklahoma, Stanford University and the University of Michigan, with several of the incidents occurring after holiday breaks. The University of Pennsylvania had its email system disrupted during a cybersecurity incident in October, while Columbia and Harvard universities both faced attacks last year.