{"id":175374,"date":"2025-01-29T15:14:07","date_gmt":"2025-01-29T14:14:07","guid":{"rendered":"https:\/\/www.erasmusmagazine.nl\/en\/?p=175374"},"modified":"2025-12-19T11:27:40","modified_gmt":"2025-12-19T10:27:40","slug":"hackers-had-stolen-login-credentials-from-eindhoven-university-of-technology","status":"publish","type":"post","link":"https:\/\/www.erasmusmagazine.nl\/en\/2025\/01\/29\/hackers-had-stolen-login-credentials-from-eindhoven-university-of-technology\/","title":{"rendered":"Hackers stole login credentials from Eindhoven University of Technology"},"content":{"rendered":"
\n
\n
\n
\n

The hackers at Eindhoven University of Technology had access to the login credentials of a student and an employee, reports de Volkskrant. The university has informed other institutions.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\"\"

\n\t\n\n<\/svg>\n<\/span>\n\tImage by:<\/span>\n\n\t\t\t\n\t\t\t\t\t\t\tWesley Klop<\/span>\t\t\t\t\t<\/span>\n\t<\/p>\n<\/figcaption><\/figure>

\n

In the middle of the weekend, almost two weeks ago, cybersecurity experts from Eindhoven University of Technology detected intruders on their network. To ensure that no data could be stolen, the IT team shut down the entire network.<\/p><\/div>\n

De Volkskrant now reports<\/a>, based on anonymous sources, that the intruders gained access using stolen \u2018keys\u2019. The hackers had the passwords of a student and an employee at the university.<\/p>

Phishing<\/h2>

It is common for passwords to be leaked or stolen through phishing emails. To prevent direct logins using these credentials, the vast majority of educational institutions have two-step authentication, says the joint ICT organisation Surf in response to inquiries.<\/p>\n

Employees and students must enter an additional security code after logging in, usually generated by an app on their smartphone. The question remains whether the hackers bypassed this second step. It\u2019s also possible that not all of the university\u2019s applications were protected with this extra layer of security.<\/p>\n

Shared<\/h2>

According to de Volkskrant, TU\/e shared information about the hack with other educational institutions. In response, Radboud University announced<\/a> last week that it had expedited the implementation of two-step login for a specific application, EduVPN. For many other applications at the university, users already had to enter an extra code when logging in.<\/p>\n

EduVPN is an application by Surf that allows remote workers to connect to the university\u2019s network. The institutions themselves determine the level of security on the application, explains Tom Hoven, spokesperson for Surf. \u201cOur advice to institutions is to do this in a risk-based manner. Universities know where sensitive data is stored, so they decide where to implement two-step authentication.\u201d<\/p>\n

Last Monday, TU Eindhoven\u2019s network was functioning properly again, and classes have fully resumed. The university has hired FoxIT to further investigate the hack. The police are also investigating, reports<\/a> the university newspaper Cursor. The university plans to make the lessons learned from this hack public in April.<\/p>\n\n\t

\n\t\t\n\t\t
\n\n\t\t\t\t\t\t\t

Read more<\/h2>\n\t\t\t\n\t\t\t