Significant security risks when using cloud-based services (E-Mail Clients and Backup) Significant security risks when using cloud-based services (E-Mail Clients and Backup)

Cloud-based email programs such as the new free Outlook app and other email client applications (please see below) can be used to transmit secret login data and email contents to third parties without notice (see news from December 6, 2023). The use of cloud-based email clients and backup services, therefore, poses a significant threat to data and information security at the University of Bonn, according to the IT security and Data Protection Officer of the university.

The fee-based Outlook programme (from Microsoft Office) is not affected and you can continue to use it. There are currently no security concerns here, as these applications communicate directly with the University of Bonn's email servers and no data is transferred to the Microsoft cloud.

In order to prevent the disclosure of access data and data leakage, the use of the following programmes, in combination with your Uni-ID, is not permitted for information security and data protection reasons and must be discontinued immediately, in accordance with the HRZ user regulations (see § 3 para. 2 clause 5):

• Outlook-App for Android und iOS,
• "New Outlook for Windows" (included in Windows 11 starting with version 23H2),
• Windows Mail (precursor of "New Outlook")
• Outlook for macOS (when using IMAP with CloudSync),
• Google-Mail (Cloud and POP3 direct access),
• Edison Mail,
• Newton,
• BlueMail (under certain conditions on mobile devices),
• Spark and
• Xiaomi Mail.

What to do now?

If you are using one of the programmes listed above, please change the product immediately and then change your Uni-ID password.

The HRZ will block the retrieval of e-mails by cloud-based e-mail programmes from 30 March 2024 by taking appropriate technical measures. This means that you will no longer be able to receive or send emails via the programmes listed above.

Security issues using cloud-backup

Please note that the backup services offered by Google and Apple are highly problematic as well and must not be used, when they cause university data (including login data) to be transferred to external cloud servers.