Questions about the data security incident

Listed in chronological order.

Updated on September 28, 2026, 6:00 p.m.:

How many data sets are affected?

According to the latest forensic findings, approximately 600,000 data sets relating to both current and former students are affected by the incident.

Why are former students only now expressly being mentioned as affected individuals?

LMU was only able to describe the scope in greater detail after evaluating the analysis results. The affected data set comprises enrolment data relating to current and former students over a period of approximately 50 years.

What data are affected? Does this include health data?

Standing data and enrolment data are affected. Since 2005, bank details are also affected in some cases. Depending on the individual case, health insurance numbers, BAföG numbers, data relating to students’ course of study and previous qualifications provided at enrollment, as well as information on reasons for leave of absence, may also be affected. Reasons for leave of absence may in some cases contain sensitive data within the meaning of Article 9 GDPR. Not every data category affects every individual.

Which cohorts may be affected with regard to bank details?

Until 2005, no bank details whatsoever were collected, so they cannot have been affected by the cyberattack. This category of data may only be relevant from 2005 onward. (Note: This question and answer were added on October 2, 2026.)

Are grades, examinations or academic papers affected?

LMU examination information, as well as specific information on course content and individual academic performance, is not affected.

Can you rule out misuse?

No, we cannot rule out misuse. However, based on the findings to date, we have no indications of publication or further misuse.

Why does LMU retain data relating to former students for such a long period?

As a public institution, LMU is required to process certain study-related information on a long-term basis in order to perform its public functions and in accordance with information responsibilities of public administration. This includes, for example, evidence for the statutory pension insurance scheme or the determination of university semesters.

From when can students enrol again?

New LMU students have been able to enrol again since 22 September. The IT system required for this purpose was rebuilt, checked for IT security and has been usable since 22 September. The relevant enrollment deadlines were extended accordingly, so that no disadvantage arises for students. Existing enrollments remain valid without change.

When will LSF be available again?

LSF will be made available again in stages on Wednesday, 30 September 2026: from 9:00 a.m. for programme coordinators and from 3:00 p.m. for students.

Which functions can initially be used?

Initially, the most important functions for the start of the winter semester will be available. These include the amendment of courses by teaching staff and programme coordinators, as well as students’ registration for courses and access to their grade reports. Further functions, including examination administration, grade entry, email dispatch and the file repository, will be introduced gradually after 30 September.

How can LSF be accessed?

For security reasons, LSF is initially not freely accessible via the internet, but only via the Munich Research Network (MWN) and the LMU administrative network. On site, access is possible via the relevant Wi-Fi network provided; a solution is also available for LMU University Hospital. Outside LMU, a VPN connection is required. Please use Edu-VPN to access the MWN. Information is available at www.lmu.de/vpn.

Why might grades still be missing from the grade report?

While LSF was unavailable, examiners were unable to enter all grades. Missing entries will be added promptly.

What applies to registration periods?

The adjustments to registration periods already discussed with programme coordinators will be implemented and communicated to you. For further extensions or amendments, coordinators should contact HISLSF.support@verwaltung.uni-muenchen.de.

When will EvaSys and EvaExam be accessible again?

EvaSys and EvaExam will again be available via the Munich Research Network and the LMU administrative network from Monday, 28 September 2026, at 12:00 noon.

When will OpenCampus and Apte be made available again?

The IT security checks of OpenCampus, including the Faculty of Medicine’s campus portal, and Apte (including aptitude assessment procedures) have not yet been completed. LMU will provide information on their restoration as soon as possible.

Update as of 22 September 2026, 11:00 a.m.:

Is it safe to enrol again?

Yes. New students at LMU can now enrol again. The IT system required for the enrolment process has been newly set up, reviewed from an IT security perspective, and has been available for use since today. The relevant enrolment deadlines will be extended accordingly, so that students will not be disadvantaged as a result. Existing enrolments remain valid without any changes.

Registration: Registration - LMU Munich

International Office: Registration for international applicants - LMU Munich

Updated on September 20, 2026 9:30 p.m.:

When and how did LMU respond?

Immediately after becoming aware of the incident, LMU established a coordination task force under the leadership of the LMU President, which has been working continuously ever since. Our internal IT and cybersecurity specialists are working around the clock to investigate the incident, secure the affected systems, and restore normal operations. They are supported by external experts in IT security and digital forensics, data protection and digital law, and crisis communications. At the same time, LMU has been coordinating closely with the relevant supervisory and law enforcement authorities since the incident became known.

Have passwords or the LMU user ID been compromised? Do I need to change my password for my LMU user account?

Passwords and the LMU user IDs have not been compromised. Regardless of this incident, we recommend changing passwords regularly.

Why are certain LMU systems currently unavailable?

No systems other than the enrollment system have been compromised. However, some systems have been taken offline as a precautionary measure in order to provide additional protection. Intensive efforts are currently underway to restore systems that were taken offline as a precaution as soon as possible. Priority is being given in particular to the Online Course Catalogue (LSF) and the Campus Portal of the Faculty of Medicine.

When can I register for my courses in the Online Course Catalogue (LSF) or the Campus Portal of the Faculty of Medicine?

We will provide advance notice as soon as these systems can be safely restored. Registration deadlines will be extended accordingly.

Where can I find information about enrollment certificates and payment options?

Information on enrollment certificates can be found here: Official certificates and confirmations - LMU Munich

Information on paying the semester fee can be found under “Paying the Semester Fee and Applying for an LMUcard” on the page: Registration - LMU Munich

Information from September 19, 2026:

What happened?

An unauthorized actor gained access to standing data relating to student registrations stored in an LMU IT system. Currently, we must assume that these data were in fact retrieved. We have been able to prevent any modification or other manipulation of the data, and the data continue to be available to LMU. The technical and forensic investigation into the attack, conducted in close cooperation with the Bavarian State Criminal Police Office, is still ongoing.

When was the incident detected? How long did the incident last?

The incident was identified on 16.09.2026. Immediately upon detecting the first signs of unauthorized activity, we took countermeasures and shut down the affected system. We currently cannot provide any definitive information as to when the unauthorized attack began and how long it lasted.

What data was affected?

The following categories of data were affected, insofar as the relevant information was provided in the course of registration: identifying data (name, date of birth, gender, and (in some cases) place or country of birth); contact details (term-time and home address, (in some cases) phone number, LMU email address, and (in some cases) further email addresses); and bank details (e.g., IBAN, name of account holder). Health insurance numbers may also be affected. BAföG numbers and data relating to students’ course of study could be affected, along with information concerning previous school and academic qualifications. In individual cases, data that are relevant to reasons for leaves of absence and, in this respect, fall under Article 9 of the GDPR, may also be affected. Information relating to examinations at LMU, as well as specific information concerning course content and individual academic performance, is expressly not affected.

How many people and datasets are affected? What time period does the data cover?

The technical investigation is still ongoing. At this time, we cannot provide reliable estimates of the total number of people, data volume, or periods affected.

What actions did LMU take after detecting the incident?

Immediately after the first indications of the incident, LMU took highly comprehensive countermeasures and removed the affected component from the system. Since then, LMU has been working with the competent law-enforcement authorities and with external specialists, including on defending our systems from further attacks. In addition to the enrollment server affected by the incident, we also took certain unaffected systems offline as a precaution. As a result, some internal services are temporarily unavailable. We are analyzing the affected datasets and have initiated an expansion of security monitoring and a technical and organizational hardening of the affected IT systems. In addition, qualified specialists are monitoring whether signs of the affected data show up in relevant portals on the so-called darknet.

Have the data been published, or are there any indications of misuse?

Based on the information currently available, we have no indications that the attacker has published the dataset obtained, intends to do so, or has otherwise misused the data. If our enhanced monitoring or the ongoing investigation reveals any evidence that the data has been published or otherwise misused, we will notify the affected individuals without delay.

What effects does the incident have on teaching/studies and registration?

Teaching and studies are unaffected. Registration will resume as of this coming week after a brief interruption. (Update: Enrollment will be possible again as of September 22, 2026.) Affected registration deadlines will be extended accordingly, so that students are not put at any disadvantage in their studies. Existing registrations will remain perfectly valid as before.

Are other systems affected by the incident?

In the course of our security protocol, we shut down various unaffected systems as a precaution in addition to the registration server affected by the incident. This has caused some internal services to be temporarily unavailable.

The following answers are intended primarily for applicants and other individuals whose data were processed in the affected system.

Are my data affected?

Analysis of the data is still ongoing. As soon as we know more, we will inform the people affected.

Should I expect my data to be published or misused?

There are currently no indications that data from the attack has been published or otherwise misused. Should the additional monitoring put in place by LMU or the ongoing investigation reveal any such indications, we will notify those affected without delay. As a precaution, however, we recommend that people be especially vigilant and observe the general data security guidelines.

What should I do now?

Although there is currently no reason to assume that the attacker intends to misuse the data, we advise you to remain particularly vigilant and follow standard security precautions. For your own protection, please observe the following in particular:

• Do not open any attachments or links, even in emails that seem to be addressed to you personally – whether from known or unknown senders – without carefully inspecting them first.
• Be very wary of suspicious approaches by email, telephone, or text message, especially ones that make reference to LMU or your studies. Specifically, do not reveal any bank details or passwords.
• Be particularly on your guard if you receive documents or messages that make reference to LMU or your studies.
• You can find further information about how to protect yourself against fraudsters on the website of the German Federal Office for Information Security: https://www.bsi.bund.de.

Should I change passwords and bank details?

As general advice, we recommend being highly vigilant and observing the above mentioned general data security guidelines.

Do I have to repeat the registration process?

New registrations that were completed before the portal was shut down were securely stored. You do not have to register again.

When are registrations open again? What about the deadlines?

Teaching and studies are unaffected. Registration will resume as of this coming week after a brief interruption. Affected registration deadlines will be extended accordingly, so that students do not suffer any impediments to their learning. Existing registrations will remain perfectly valid as before.

Where can I turn if I have further questions?

For any questions, please contact: cybersicherheit@lmu.de