Munich University Breach Exposes Student Financial and Health Data

Ludwig Maximilian University of Munich (LMU), one of Germany's largest universities with over 52,000 students, is investigating a cyberattack that allowed an unidentified hacker to access enrollment data stored on one of its IT systems. The university confirmed it must assume the data was retrieved, though there is currently no evidence it has been altered, deleted, published, or misused.

The potentially exposed information includes students' names, dates of birth, contact details, bank account information, course details, and prior education records. Health insurance numbers and identifiers tied to Germany's student financial aid program may also be affected, along with sensitive details in some cases about why students requested leaves of absence. Academic records such as exam results and coursework performance were not affected.

LMU detected the breach on Wednesday and responded by disconnecting the affected server, engaging external cybersecurity specialists, and notifying law enforcement. As a precaution, several unaffected systems were also taken offline, briefly disrupting some internal services and pausing enrollment, which is expected to resume this week. The university has not disclosed the attacker's identity, whether a ransom was demanded, or how many people are affected, and the investigation continues.