That same evening, at 7:35 pm, the university’s IT staff noticed that the network was slowing down. Soon after, the university went into crisis mode: it had become the target of a cyber-attack. Vital systems stopped working. To prevent the situation from getting worse, everything was immediately shut down. It was the start of a nightmare that lasted more than a week and had consequences that dragged on far longer. From timetables and emails to research data, nothing could be accessed – until the university paid up. This was ransomware: the hackers said they would provide a digital key to unlock everything once payment was made.
How could this have happened? Was UM’s cybersecurity really that weak? As the university later admitted, that was indeed the case. Too many systems that should have been separate were interconnected, and too many people had system-wide access. A well-planned attack stood a good chance of success. And it was well planned. Two months earlier, on 15 October, the hackers had sent phishing emails with links to the university – and someone had clicked on one. The next day, someone else did the same. It opened the door to malware that quietly mapped the entire network. As the final blow, UM got a Clop virus for Christmas.
Crisis centre
A university being brought to a standstill is no small matter. It made national news. But in those first few days, communication with both the university community and the media was poor. The Executive Board’s spokesperson was on holiday and saw no need to report to the hastily set-up crisis centre, led by Executive Board member Nick Bos, in the library on Grote Looiersstraat. As a result, his predecessor Fons Elbersen was brought in on 26 December. Another key figure was Bart van den Heuvel, the university’s Chief Information Security Officer. Ten months later, in an interview published online by Géant – a European network including SURF, the IT cooperative of Dutch education and research – Van den Heuvel revealed that he communicated with the hackers via his private email account. He insisted that from the outset, the communication strategy had focused on “transparency (…) everything communicated internally was also shared externally”.
At the time, Observant and other media outlets experienced things rather differently. If we managed to get hold of anyone at all, the responses were brief. For example, an external cybersecurity firm had been brought in, but the university refused to disclose which one. It later turned out to be Fox-IT. Spokesperson Elbersen was unflappable: “I keep reading that we are negotiating. I’ve never used that word.”
"Impossible dilemma"
But negotiations were clearly taking place. Nick Bos later called it an impossible dilemma – pay the ransom or leave the university paralysed for months? – but the Executive Board actually reached its decision within days. Just after Christmas, it was said that teaching would resume on 6 January. “That means they’ve paid up”, cybersecurity experts said. And they were right. On 30 December, internal sources who disagreed with the university’s lack of openness on the matter told Observant that the criminals had been paid around €200,000 to €300,000 (later confirmed to be 197,000 in bitcoin). At Elbersen’s urgent request, publication was delayed until 2 January to avoid interfering with the crisis team.
It was not until 5 February that UM finally gave a full account of what had happened – which was in itself unprecedented.