The data of not only current students but also of those who studied at the university several decades ago was compromised. Someone who enrolled in 1976 may also be among those affected. By comparison, more than 52,000 people were studying at LMU in the 2025/26 winter semester.
The Entire Admissions System Dataset Is Affected
In mid-September, unknown persons gained access to one of the university’s central IT systems. A little over a week ago, the media reported a serious hacker attack on LMU. The university has now clarified the details: “It is currently known for certain that the entire dataset in the admissions system was affected.” This system holds information on current and former students.
According to university representatives, the archive contains enrolment data on applicants over the past 50 years. In total, it holds about 600,000 records.
What Data Was Affected
The scope of the leaked information depends on the year to which a record belongs:
- before 1994, only basic personal data and details of the course of study were affected;
- from 2005 onward, a broader set of information was affected, including bank details, contact data and identification information.
The university stressed that passwords, exam data and students’ academic performance records were not stolen.
Why Data Is Stored for 50 Years
LMU explained that the university is required under German law to process certain data over a long period. This data is needed, for example, to confirm periods of study for pension insurance purposes and to calculate the total number of semesters spent at the university. The retention period is 50 years, which is in line with the common practice of German universities.
Investigation and Restoration of Systems
The university has brought in external cybersecurity specialists to establish the circumstances of the hacker attack. In addition, LMU is continuously monitoring the dark web. There are still no signs that the stolen information has been published or otherwise used, but the university cannot rule out further misuse of the stolen data.
Systems that were shut down as a precaution are gradually being brought back into operation. For example, the online lecture catalogue became available to students on 30 September at 3:00 p.m. University representatives advise people to be more vigilant about suspicious emails, calls and messages that mention LMU or studies.
Summary
The attack affected hundreds of thousands of records, many of which belong to people who graduated long ago. The law obliges the university to retain such data for decades. There are as yet no traces of the data being published; the investigation and the restoration of computer systems are continuing.
