Hacker attacks take Leipzig university offline and expose Charité contact data

Leipzig university stays offline

The University of Leipzig has kept its servers switched off since Wednesday morning, 28 October, when it took all internet-connected servers offline after a hacker attack. A spokesperson said the servers would be restarted at the earliest on Monday, 2 November. Email for staff and students remains disrupted, but faculties and central facilities such as the university library, the sports centre and the language centre can again be reached by email through an external system.

Spiegel Online reported that around 30,000 students are affected, and that the causes of the attack were still unclear on Thursday, 29 October. A crisis team is working intensively on the problem, and the university's first priority is the security of all data. An IT emergency service provider has been brought in, and the university hopes to restore regular operations at least partly soon.

Lectures continue in their planned rooms, and the university library stays open over the weekend. The deadline for home and final theses has been extended to 6 November. The university has filed a criminal complaint against persons unknown, and it distributes updates through a replacement website at the familiar web address and through its Instagram account.

The university also said that the public presentation of candidates for the rectorate election, scheduled for Friday, 30 October, goes ahead as planned. It cannot be broadcast live, as the university stated:

“A livestream is not possible because of the IT attack.”

Charité contact data stolen

On Friday, 30 October, the Charité announced that unauthorised people had gained access to a server of the Berlin university hospital and stolen personal contact data. Affected are staff, students and external contacts, including people who used the web contact form of the clinic to request an appointment. According to the clinic, names, email addresses and, where applicable, organisational affiliations were taken.

The Charité stressed that patient care was not affected by the incident, and it said sensitive data were not included in the theft. The clinic has no evidence that the stolen information has been published, passed on or misused. It will inform everyone affected personally and has asked them to stay alert if strangers contact them. The number of people affected has not been disclosed.

How the breach was handled

The Charité website was temporarily unreachable on Tuesday, 27 October, reportedly because the affected systems were taken offline once the attack became known. A spokesperson said the access route used by the attackers was quickly identified and closed, and that the cause was analysed and protective measures were strengthened.

The clinic has filed a criminal complaint, is in contact with supervisory and investigative authorities, and has brought in an external IT company for support. It also said the attack is not linked to a PHP security flaw that had previously led it to take its website offline temporarily as a precaution.

Wider pattern and next steps

Universities and research institutes, including those in the Berlin region, are repeatedly targeted by hacker attacks. Both incidents became public within the same week, and the Charité's notifications to affected people are still outstanding. The Leipzig servers are not expected to return before Monday, 2 November, at the earliest.

For now, the Leipzig university's most visible problems are email and online services, while teaching and library access continue. Whether the Charité's stolen contact data surfaces elsewhere remains unknown to the clinic, which has said it has seen no signs of misuse so far.