Breaches and incidents
Ludwig-Maximilians-Universitaet Muenchen: attacker accessed server with student data including bank data
LMU said (19 Sep) an unauthorized attacker gained access to a server and that it must assume the data was retrieved.
- Disclosed
- Verification
- Checked against a primary source
What happened
- LMU said (19 Sep) an unauthorized attacker gained access to a server and that it must assume the data was retrieved: identifying data, contact data, bank data and possibly health insurance and BAfoeG numbers, study progress data and some special-category data on leave reasons; exam information was explicitly not affected. LMU gave no count; MDR, citing media reports, said around 600,000 records spanning 50 years could be affected.
- Root cause: not disclosed; forensic investigation ongoing.
- No attacker named.
- The server was isolated, forensic specialists engaged, the investigation runs with the Bavarian LKA, and LMU notified affected people under Art. 34 GDPR.