Inter-university IT Service Information Security (HITS IS)
- HITS IS
- ISMS Consulting
- Conducting internal audits
- ISMS consulting and support of the GRC tool
- IT Emergency Management - Consulting
- IT emergency management in the GRC tool
- Security Awareness - Concept
- Security Awareness - Classroom Training
- Vulnerability scanning service
- OSINTaaS - Shadowserver as a Service
- OSINTaaS – Leak Notifier
- Information Exchange (MISP)
- ThreatWatch
- eduCSIRT – Emergency Infrastructure
- eduCSIRT – Incident Response
The Leak Notifier service is part of the HITS IS Open Source Intelligence as a Service (OSTINTaaS) and provides timely information when access data is available in published data breaches when using e-mail addresses with Bavarian university domains.
A data breach is an incident in which unauthorized persons have gained access to (personal) data or the data has been unintentionally leaked to the public by the data holders.
Scope of Services and Service Specifics
- Initially, one message per university (with its university domains) with a collection of e-mail addresses from previous breaches from the past (04/2025 – 60 known Bavarian university domains).
- Continuous reports to universities affected by new breaches (the e-mail address of university members is present in a new leaked data set).
Service Parameters
Depending on the breach and the affected service, in addition to the email address, other compromised data such as password, password hints, gender, location, name, username, phone number or physical address may be present in the breach's records.
It is up to the quality of the data sources used (see above) about which breaches users can be informed.
Requirements
- The university does not need any Requirements to be able to receive the service.
- Messages from the service are initially delivered to the e-mail addresses of the ISB.
- If the messages from the service are delivered to a different or additional mailbox, the desired mailbox must be reported to informationssicherheit@remove-this.digitalverbund.bayern.
- If a domain of a university changes or a new domain is added, it must be reported to informationssicherheit@remove-this.digitalverbund.bayern in order to receive notifications for these domains.
User / Customers
This service is made available to the following categories of users.
| User class | Note |
|---|---|
| (1), (2) | only for members of the Digital Network of Bavaria |
| (3), (4), (5), (6) | not available for these customers |
The service can be requested by CIO, CISO, ISB or data center management of the universities in the digital network via e-mail to informationssicherheit@remove-this.digitalverbund.bayern .