Leipzig University cyberattack shuts down IT

Leipzig University will stay offline at least until Monday 2 November. Its servers, which were switched off on the morning of Wednesday 28 October after an attack on the university's IT systems, will be restarted on Monday at the earliest, a spokesperson told the news agency dpa on Friday 30 October. The Leipzig University cyberattack has knocked out the central website, university email and the Almaweb study portal. Teaching in lecture halls continues, deadlines for term papers and theses have been pushed back to 6 November, and the university has filed a criminal complaint against unknown persons.

What happened in the Leipzig University cyberattack

A university spokesperson told dpa on Wednesday that all internet-connected servers had been switched off to prevent further damage. Press spokesman Carsten Heckmann told the Leipziger Volkszeitung (LVZ) that the university had actively decided, as an acute security measure, to take all of its services off the network as a precaution. The university's first notice about the incident appeared on an emergency page at 11:10 am on Wednesday, according to the web magazine Dr. Web.

The shutdown affects more than the public website. Students and staff cannot send or receive email through their university addresses. The internal webmail system Horde and Almaweb, the portal students use to manage their studies, are unavailable, as is the learning platform Moodle, according to the university's own FAQ. On Thursday the university said that all IT services were still offline and that regular operations were severely restricted.

On Friday the university gave a first indication of how long the outage will last. According to dpa, the servers will not be switched back on before Monday, so the university remains offline at least over the weekend. Email for students and staff is still disrupted, but the faculties and central units such as the University Library, the university sports centre and the language centre can be reached by email again through an external system, dpa reported.

Was data stolen? What is known so far

A key question about the Leipzig University cyberattack remains unanswered. The spokesperson told dpa on Wednesday that it was not yet clear whether attackers had accessed student data, and he could not say how the university's security systems had been breached. The university has said that data security is its top priority, but its public updates up to Friday evening did not say whether any data had been taken. It has not said who is behind the attack or whether there has been any ransom demand.

On Thursday the university announced that it had set up a crisis team led by Rector Eva Inés Obergfell. Staff from the university computing centre are analysing the incident together with an external IT emergency response company, and the relevant authorities have been informed. On Friday dpa reported that the university had also filed a criminal complaint against unknown persons (Anzeige gegen Unbekannt).

Whether the attack also triggers reporting duties under data protection law depends on what the analysis finds. Dr. Web pointed out that the EU's General Data Protection Regulation (GDPR) sets a 72-hour deadline, a rule that applies to universities as well as companies. Under the regulation, a personal data breach has to be reported to the data protection authority within 72 hours of the organisation becoming aware of it, unless the breach is unlikely to result in a risk to the people concerned. If the risk to them is high, they generally have to be informed directly as well.

A possible link to the PHP security flaw

The Leipzig University cyberattack came one week after Germany's Federal Office for Information Security (BSI) issued an urgent warning about two critical vulnerabilities in PHP, a programming language that runs a large share of the world's websites. ZDF reported on 21 October that the flaws, nicknamed PHP2Shell, could allow attackers to run malicious code on web servers remotely and without logging in. The BSI rated the risk as extraordinarily high and advised operators to update immediately or, if in doubt, take servers offline. Several public bodies did exactly that as a precaution.

According to the LVZ, Leipzig University had been installing updates since the vulnerability became known, but not all of its systems were up to date when the attack happened. The LVZ said it was unknown whether the attackers had targeted systems that were still unpatched. The university itself has not confirmed any connection, and the link should be treated as unproven until investigators say more.

Deadlines, classes and how to reach the university

In-person classes continue as planned in their usual rooms, the university says, while online classes may be postponed or moved to external servers. Written work that does not require attendance, such as term papers (Hausarbeiten) and final theses (Abschlussarbeiten), and that was due on or after 28 October, now has a deadline of 6 November 2026. The university said it would publish more specific deadlines during the following week. The extension does not apply to state examinations (Staatsexamen), for which students should contact the state examination office.

The University Library (Universitätsbibliothek) stays open, including at the weekend, the spokesperson told dpa. According to the university's FAQ, its sites and study places can be used, but lending, ordering, renewals and the catalogue are unavailable, and the library's PCs and the eduroam Wi-Fi are down. Books can be returned at the service desks, and no fees are charged for the duration of the outage.

Because normal email addresses do not work, the university has set up a temporary website at its usual address with a phone number and alternative contact addresses on a separate domain, uni-l.info. Students are asked to contact lecturers by phone or in person, or to use the general contact address of their faculty or institute. The Student Service Centre (Studierenden Service Zentrum) is open Monday to Thursday from 9 am to 12 noon and from 1 pm to 4 pm, and on Friday from 9 am to 12 noon. Updates are also posted on the university's Instagram and Mastodon accounts.

What the Leipzig University cyberattack means for international students

Many of Leipzig University's students come from abroad, and many of them depend on university paperwork for their residence status, health insurance or housing. If you need a document that you would normally download from Almaweb, such as a certificate of enrolment, go to the Student Service Centre or your study office in person and ask what they can issue. If an appointment at the immigration office (Ausländerbehörde) or another deadline depends on that document, tell the office about the IT outage early and keep a note of the university's official announcements as evidence. You can read more about the rules in our guide to student visas and permits.

Take care with messages that claim to come from the university. While the official mail system is down, any email, text message or call that asks for your password, bank details or a payment in the university's name should be treated as suspicious. Check information only on the official temporary website or the university's verified social media accounts. If the university later asks students to reset their passwords when the systems come back, follow only the instructions published through those channels.

For now, students should keep copies of their own work offline, note the new 6 November deadline and expect further changes once the servers are restarted and the analysis is complete. More news from the city is collected in our Leipzig Lines section.