Hackers stole the login passwords of everyone registered on a top German university's portal. If you reuse passwords, this kind of breach can reach other accounts.
Attackers have stolen the central login passwords of everyone registered with myTUM, the online portal of the Technical University of Munich. The university disclosed the attack on November 6. It is Germany's top-ranked university in the QS rankings, and it reports 51,954 students and 12,850 employees.
The attackers first hit myTUM, which gives students and staff one place to reach services and documents. Among the stolen logins was an administrator's. The attackers used it to attack a second system, TUMonline, the central campus management system. The IT team took TUMonline offline. Access came back on Monday morning so users could change their passwords.
Names, home addresses and dates of birth may have been accessed. Employee records may also include work addresses and phone numbers. Student records may include ID numbers, degree programs and completed semesters. TUM's CIO, Dr Alexander Braun, said the attackers' activity in TUMonline was largely logged. Based on those logs, the university currently assumes that grades and college applications were not taken. The investigation continues.
TUM says accounts with multi-factor login switched on were protected from this attack. Multi-factor login means a second step after your password, such as a code or an approval on your phone. Accounts without it were the exposed ones.
TUM has not said how the attackers first got in or how the stolen passwords were stored. It has not said how many users are affected. It also has not said whether the administrator had multi-factor login turned on.
The alert box above lists the steps. The main point is that a password stolen here is dangerous anywhere it is reused. TUM itself told users to change any password they use on other sites. It also warned people to watch for phishing, which means fake messages meant to trick you into handing over details.
For the reset itself, TUM points users to Microsoft 365 where possible. People who have not set up multi-factor login must use a German electronic ID instead, or request a reset email while connected to the campus network.
If you are tied to this university, change your password now, and change it anywhere else you reused it. Turn on a second login step.
Deputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersNew York's attorney general released a guide to help veterans and service members spot pension scams, shady VA benefits offers and phishing before money is lost.
Read more: New York warns veterans and service members about scamsCallers claiming to be U.S. Marshals say you missed a grand jury subpoena and face arrest. The sheriff's office says it is a scam and wants you to hang up.
Read more: Fake federal warrant calls are targeting Kentucky residents
