Munich data leak exposes personal details of over 100,000 students and staff

A data breach at LHM Service GmbH, a wholly owned subsidiary of the city of Munich responsible for IT at roughly 900 schools, sports facilities and kindergartens, has resulted in more than 100,000 personal records being transferred to the darknet. The leaked information includes names, addresses, birth dates, school affiliations and nationalities of students, teachers, school administrators, and employees of municipal education and sport departments.

The breach was uncovered by an exclusive investigation of the Abendzeitung München, which verified the authenticity of the data through contact with affected individuals. LHM Service has not yet classified the incident, but an internal review is underway. A criminal complaint has been filed and the data‑protection supervisory authority has been notified. The company suspects a former employee who, on his last working day in 2024, may have downloaded a large volume of data and transferred it.

Munich’s mayor Dominik Krause said any violations must be fully clarified, emphasizing the city’s commitment to investigating the leak and protecting citizens’ privacy.