LMU München reports cyberattack and theft of student enrollment data

Ludwig-Maximilians-Universität (LMU) München has reported a serious cyberattack involving the unauthorized access and copying of student enrollment data. The breach, which was detected in mid-September 2026, targeted master data from a university system.

The stolen information includes highly sensitive personal and financial details, such as names, dates of birth, addresses, telephone numbers, and email addresses. Crucially, the attackers also obtained bank details including IBANs and account holder names. Other potentially compromised data includes health insurance numbers, BAföG (student financial aid) numbers, and information regarding previous school or study qualifications.

While the exact number of affected individuals has not been finalized, estimates suggest the breach could impact between 52,000 and 53,000 enrolled students. The university has clarified that examination results, specific study contents, and individual academic performances were not affected by the attack.

In response, LMU's IT department isolated and shut down the affected servers to prevent further data loss. The university has engaged external forensic experts and is working closely with the State Criminal Police Office (Landeskriminalamt) to investigate the incident.