Press release

10.11.2026

IT Security Incident at the University of Tübingen

Cybercriminals tap 3,900 employee records – University plugs security breach – Affected persons informed

Persons unknown launched a cyberattack on University of Tübingen systems. They were able to tap some 3,900 data sets. The stolen data consists of given names, family names, dates of birth, work email addresses, and usernames, as well as information on University staff members’ departments. Students are not affected. No passwords were leaked.

The University discovered the security vulnerability and immediately took steps to prevent further attacks through it. The University IT Center (ZDV) has logged the attackers' access attempts. Based on an analysis of these logs, the University currently believes that no other data has been compromised. The investigation into the incident is ongoing. All affected individuals will be notified directly.

Criminal complaint is being filed

Several settings recommended by a software provider, when combined, created a security vulnerability. This allowed the attackers to access features intended solely for internal use. Using these features, the attackers were able to retrieve personal data as long as they knew the respective username. The security vulnerability that the attackers exploited has been patched. The attack has been documented and is under further investigation.

The University immediately notified the University data protection officer of the incident, as well as the state commissioner for data privacy and freedom of information (Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg). A criminal complaint is being filed in connection with the cyberattack.

Downloads