What happened?
Ludwig Maximilian University (LMU) of Munich has fallen victim to a cyberattack in which personal data of students was exfiltrated. According to the university, "core enrollment data" was copied. The university did not disclose how many data records were specifically affected. Currently, around 52,000 people are enrolled at LMU.
According to a report by Bayerischer Rundfunk (BR), the attack was discovered on Wednesday of this week. Details about the exact attack vector and the duration of the undetected access are not yet known.
The Details
According to LMU, complete enrollment data records were apparently copied from the university's systems. These include, among other things:
- Name, dates of birth, and addresses
- Email connections
- Bank details such as IBAN and account holder
- Student loan (BAföG) numbers
- Health insurance information
According to the university, the affected systems were taken offline and isolated. Security monitoring has also been expanded, and a forensic investigation has been launched. According to BR, the Bavarian State Criminal Police Office (Landeskriminalamt) is now also investigating.
LMU intends to resume enrollment for the winter semester, which begins on October 12, shortly; the corresponding deadlines are to be extended. The university assures that students will face "no disadvantage to their studies."
According to LMU's findings so far, this does not appear to be a classic ransomware attack. There is "no evidence that the attacker has published, intends to publish, or otherwise misused the obtained data set." Specialists are also reportedly monitoring relevant darknet portals.
Context
The incident once again demonstrates how attractive university IT systems are to attackers: universities manage large volumes of highly sensitive personal data, often through grown, complex IT landscapes with numerous interfaces and legacy systems. Enrollment data is particularly critical in this regard, as it includes not only standard personal details but also financial information such as bank details.
The combination of the stolen data is especially significant: with names, dates of birth, addresses, bank details, and insurance information, attackers have access to nearly everything needed for identity theft or targeted fraud schemes. Even though LMU currently assumes there has been no publication or misuse of the data, the risk of targeted phishing remains. The university does not explicitly describe the specific attack scenario as phishing, but given the volume of data stolen, the risk of corresponding follow-up attacks is evident: criminals could use knowledge of students' academic history to gain their trust in targeted scams.
Practical Tips
Several recommendations arise from this incident for those affected and university members:
- Increased vigilance regarding emails or calls referencing one's studies – especially if bank details or login credentials are requested.
- Do not disclose bank details or passwords on request, even if the contact appears trustworthy and personal details are correctly stated.
- Pay particular attention to account transactions and bank statements in the coming weeks and months.
- Follow official LMU communications regarding the incident, as further information on the scope and course of the attack may follow.
- Report any suspicious contact attempts to the university or investigating authorities.
Outlook
LMU's forensic investigation and the Bavarian State Criminal Police Office's inquiries are ongoing. So far, neither the exact attack vector nor the duration of the undetected access is known. It remains to be seen what further details the university will release in the coming days – such as the exact number of individuals affected or the origin of the attack.
LMU has already taken action regarding enrollment for the winter semester and announced extended deadlines to ensure students are not disadvantaged despite the system isolation. The case is also likely to reignite the debate over IT security at German universities, whose systems often must be protected against increasingly professional attacks with limited resources.
