2 July 2020

Successful phishing attempt: data breach

Phishing emails were sent on 30 May and 2 June. The phishing attempt managed to obtain login details from a small number of colleagues. This data breach has been reported to the Dutch Data Protection Authority as well as the police.

It appears that the aim of the attempt was to change these colleagues' bank account numbers in their personal HR environment so future salary would be transferred to a different account. While we fortunately managed to prevent this, we are unfortunately unable to guarantee that no other malicious activities were carried out, as the mailboxes were accessed. It was also possible to access the email addresses of all staff and students through the address book. Although there is no direct evidence that these details actually have been or will be abused, we request that you keep a close eye on phishing and spam.

If you are suddenly receiving a lot of spam or have received a suspicious message, please report this fact to the Computer Emergency Response Team (CERT-UU) at cert@uu.nl immediately, even if there does not seem to be much of a problem. To learn more about how to recognise phishing, take a look at this page: https://students.uu.nl/en/node/6/phishing

The implementation of two-factor authentication (2FA) will be accelerated to reduce this risk in future. As of 13 July, Office 365 will have additional security through 2FA. To learn more about 2FA, including how to configure it, take a look at this page: https://students.uu.nl/2fa

If you have any questions about personal data protection, please contact the student service at studentenservice@uu.nl or Data Protection Officer Artan Jacquet at privacy@uu.nl