University of Applied Sciences refuses to pay hacker: personal data leaked

A vast amount of personal data belonging to students, staff and other contacts of HAN University of Applied Sciences has apparently been leaked. The information was made public after HAN refused to pay a hacker money.

Higher education more often targeted by hackers

• Dutch Research Council (NWO) refuses to pay ransom to hackers
• Cyber attack on UvA and HvA: ‘acute danger gone’
• Maastricht University pays ransom money from its own private funding

The hack was discovered on 1 September, the university of applied sciences reports on its website. RTL News writes that the hacker has since posted the data online. The leaked information includes names, telephone numbers and passwords.

In addition to students, alumni and employees, those affected also include anyone who ever filled in a contact form, for example because they were enquiring about a HAN study programme.

Apologies

HAN University of Applied Sciences’ website reports that it has digital security measures in place. “We are extremely sorry that we were unable to prevent this incident despite these measures. We want to apologise for any inconvenience you may experience as a result of this situation.”

Criminals can use the data for identity theft or to hack accounts. The university of applied sciences is still investigating the extent of the hack and has posted warnings about phishing and spam in the meantime. The leaked passwords are said to no longer be in use, “according to current information”.

HAN is one of the largest universities of applied sciences in the Netherlands. It has about 37,000 students and 4,000 employees.

This is not the first time an institution of higher education has been affected by cybercrime, with the most well-known example being the ransom software that paralysed Maastricht University in December 2019. That university paid nearly €200,000 in ransom money to the hacker.