German universities are getting hacked again at the pace of 2022 and 2023, this time at the largest institutions in the country, and for some reason the coverage stays local. Munich reads about Munich. Leipzig reads about Leipzig. The national picture gets filed in a weekly incident list and a DFN slide deck.

Ten German higher-education targets since mid-September on Konbriefing’s tally: LMU München, Mannheim and Bremen in September; the Hochschulservicezentrum Baden-Württemberg, HU Berlin, Halle-Wittenberg, Leipzig, Rostock and the Charité in October; TU München in November.

Check the record for comparison, German entries on the same list by year:

The BKA logged 42 attacks on universities and research institutions from 2022 to mid-2024. DFN’s assessment in October 2025 put the steady state at about twenty reported incidents a year and concluded: “Ein neuer Trend ist in Deutschland nicht zu beobachten.” October 2026 ran at more than three times that rate.

Then November opened with the Technical University of Munich. TUM confirmed on 6 November that attackers entered through the legacy myTUM portal and reached passwords, names, home addresses and dates of birth for roughly 60,000 students and staff. The stolen credentials were then used against TUMonline, the central campus management system, which the university pulled offline. Accounts with two-factor login were untouched. myTUM will remain permanently offline.

Seven weeks earlier, across town, LMU München reported an intrusion into its enrolment system. Around 600,000 records of current and former students were exposed, including bank details, with data reaching back fifty years.

The Rectors’ Conference asked the federal government in February 2025 to fund university cybersecurity directly. TUM’s own account of the incident shows where and why that matters. Any accounts with a second factor held. The legacy portal did not hold.