Loading story…
Ludwig Maximilian University of Munich (LMU) disclosed an IT security incident in which attackers apparently copied extensive student enrollment records. Potentially exposed information includes identity and contact details, along with sensitive financial data, BAföG student-aid information, and health-insurance records.
LMU isolated affected systems, expanded security monitoring, and began forensic investigations while monitoring relevant dark-web sites for leaked data. The Bavarian State Criminal Police Office is investigating; LMU said it had no indications at the time of disclosure that the data had been published or otherwise misused.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
LMU Munich discovered an intrusion into its IT systems on Wednesday of the week reported. The university said apparently complete student-enrollment records were copied, potentially including identity, contact, bank, BAföG, and health-insurance data.
The Bavarian State Criminal Police Office initiated an investigation into the intrusion. At the time of reporting, LMU said it had no indication that the copied records had been published or otherwise misused.
LMU took the affected systems offline and isolated them, expanded security monitoring, and began forensic examinations. It also arranged monitoring of relevant darknet portals and advised students to be alert to study-related contact attempts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack on **Unimed**, a third-party billing and receivables service provider for German hospitals, exposed data from tens of thousands of patients at multiple university medical centers, including facilities in Cologne, Freiburg, Heidelberg, Ulm, Tübingen, and Mannheim. The intrusion reportedly occurred in mid-April and affected administrative and billing records tied to privately insured patients, self-paying patients, and some international patients; hospitals said their own clinical systems were not breached and patient care was not disrupted. Hospitals disclosed that the stolen information included personal details and, in some cases, highly sensitive medical and financial data such as diagnoses, treatment information, correspondence, and limited bank or payment details. Several affected institutions suspended data transfers to the provider, Heidelberg University Hospital filed a criminal complaint, and officials in Freiburg called for a full investigation, while some hospitals said they were considering legal action against Unimed. The attackers have not been identified and no group has publicly claimed responsibility.
Jun 29, 2026
Security researchers reported a large, publicly exposed database on an open cloud server containing **tens of millions of French citizen records** aggregated from at least five prior breaches, including voter data, healthcare entries, CRM contacts, financial profiles (including **IBANs/BICs**), and vehicle-related information. The dataset appears to have been compiled to increase resale value and enable identity cross-linking, elevating risks of **phishing, fraud, and identity theft**. Separately, Australia’s **Victorian Department of Education** notified parents that an unauthorized party accessed a student database containing names, school names, year levels, school-issued email addresses, and **encrypted passwords**, prompting a forced password reset and temporary account access disruption; the department stated more sensitive fields (e.g., home addresses, phone numbers) were not exposed and investigators had not confirmed public release. In another unrelated report, researchers questioned the veracity of a newly claimed **PayPal** breach, assessing a ~100,000-record credential “combolist” as likely **outdated infostealer-log data** rather than evidence of a fresh PayPal compromise, noting PayPal’s prior refutation of similar claims and the practical barriers posed by MFA.
Jun 29, 2026
The University of Nottingham said a cyber incident exposed a significant amount of data belonging to current and former students, and warned that people connected to its campuses in Nottingham, Malaysia, and China may be affected. The university said it is still determining exactly what was accessed, but is treating **contact details, university-related information, financial data, and sensitive personal information** as potentially compromised while a third-party forensic investigation continues. It has notified affected students and alumni and published a notice confirming that student and alumni data had been compromised. The **ShinyHunters** cybercrime group claimed responsibility on its extortion site, alleging it stole more than **40GB** of material including credit card and payment details. Analysis of partially published data by **Have I Been Pwned** indicated the leak contains about **455,000 unique email addresses** along with extensive personal information, although the full scope remains unverified and ShinyHunters has previously been accused of exaggerating or misrepresenting stolen data in extortion campaigns.
Jun 29, 2026