{"id":179232,"date":"2025-05-19T15:04:42","date_gmt":"2025-05-19T13:04:42","guid":{"rendered":"https:\/\/www.erasmusmagazine.nl\/en\/?p=179232"},"modified":"2025-12-19T11:27:49","modified_gmt":"2025-12-19T10:27:49","slug":"hacker-tu-e-allowed-to-roam-freely-for-five-days","status":"publish","type":"post","link":"https:\/\/www.erasmusmagazine.nl\/en\/2025\/05\/19\/hacker-tu-e-allowed-to-roam-freely-for-five-days\/","title":{"rendered":"Hacker TU\/e allowed to roam freely for five days"},"content":{"rendered":"

Using stolen login credentials and a few tricks, a hacker managed to penetrate the entire network of TU Eindhoven. A ransomware attack was probably averted at the last moment.<\/p>\n

\"\"

\n\t\n\n<\/svg>\n<\/span>\n\tImage by:<\/span>\n\n\t\t\t\n\t\t\t\t\t\t\tWesley Klop<\/span>\t\t\t\t\t<\/span>\n\t<\/p>\n<\/figcaption><\/figure>

On Monday morning, TU Eindhoven released reports on the hacking incident that occurred last January, leading to a\u00a0days-long disruption<\/a> of education. At that time, the university took the network offline to prevent further issues.<\/p>\n

The hacker was likely aiming to encrypt the systems, believes Fox-IT<\/a>, the company that investigated the attack for the university. With so-called ransomware, hackers can lock down the systems; you regain access after paying a ransom.<\/p>\n

Stolen passwords<\/h2>

According to an evaluation<\/a>, the university proved resilient. However, the security could be improved. The hacker accessed the network remotely using stolen usernames and passwords. Two-factor authentication (with an additional check via your mobile phone) could have prevented this.<\/p>\n

Furthermore, the university was aware that these login details had been stolen and were available on the dark web. Affected staff and students had previously been requested to change their passwords, but some \u2018changed\u2019 their password to the same (and therefore stolen) password. \u201cWe hadn\u2019t technically secured that properly\u201d, says<\/a> chief information security officer Martin de Vries to the university newspaper Cursor.<\/p>\n

Little experience<\/h2>

The hacker likely didn\u2019t have a lot of experience. After a few days, he attempted to disable the backups and installed a tool that triggered alarms. He essentially kicked the door in, De Vries tells Cursor. \u201cI expected he would want to remain under the radar for longer.\u201d<\/p>\n

Who is behind the hack remains unknown. Fox-IT detected traces of Cyrillic script, but that was not enough to determine the origin.<\/p>\n

Higher education institutions are increasingly facing cyberattacks. The most well-known case is the ransomware attack on Maastricht University, during which a ransom of 200,000 euros was paid, although the university later recouped it<\/a> with profit.<\/p>\n\n\t

\n\t\t\n\t\t
\n\n\t\t\t\t\t\t\t

Read more<\/h2>\n\t\t\t\n\t\t\t