Incident: University of Maastricht Pays Ransom After Ransomware Attack.

Published Date: 2020-02-05

Postmortem Analysis
Timeline 1. The software failure incident at the University of Maastricht happened on December 24, as mentioned in Article [95993]. Therefore, the software failure incident occurred on December 24, 2019.
System The software failure incident at the University of Maastricht involved the following systems/components: 1. Email system 2. Computers 3. IT network These systems failed due to a ransomware attack that encrypted the university's computer systems, including email and computers, leading to the payment of a ransom to unblock the systems [95993].
Responsible Organization 1. TA505, a Russian-speaking criminal group [95993]
Impacted Organization 1. The University of Maastricht [95993]
Software Causes 1. Phishing email leading to a breach in the system [95993]
Non-software Causes 1. Phishing email clicked by an unidentified staff member [95993]
Impacts 1. The University of Maastricht paid hackers a ransom of 30 bitcoin, equivalent to 200,000 euros, to unblock its computer systems, including email and computers, after the ransomware attack [95993]. 2. The ransomware attack disrupted the university's operations, affecting the work of students, scientists, and staff, as well as the continuity of the institution [95993]. 3. The alternative to paying the ransom would have been to rebuild the entire IT network from scratch, indicating a significant impact on the university's IT infrastructure [95993]. 4. The initial breach occurred when an unidentified staff member clicked on a phishing email a month earlier, highlighting the human factor in contributing to the software failure incident [95993].
Preventions 1. Implementing regular cybersecurity training for staff to recognize and avoid phishing emails could have prevented the initial breach caused by a staff member clicking on a phishing email [95993]. 2. Enhancing email security measures such as spam filters and email authentication protocols could have reduced the likelihood of the phishing email reaching the staff member's inbox [95993]. 3. Employing robust cybersecurity measures and practices, such as network segmentation, intrusion detection systems, and regular security audits, could have detected and prevented the ransomware attack before it caused significant damage [95993].
Fixes 1. Enhancing cybersecurity measures to prevent phishing attacks and unauthorized access [95993]
References 1. University of Maastricht 2. University Vice President Nick Bos 3. Cybersecurity firm Fox-IT 4. Hackers identified as TA505 5. Press conference disclosed information about the hack [95993]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: - The University of Maastricht experienced a ransomware attack that led to the payment of a ransom to unblock its computer systems [95993]. - The initial breach was caused by an unidentified staff member clicking on a phishing email [95993]. (b) The software failure incident having happened again at multiple_organization: - The article does not provide specific information about similar incidents happening at other organizations.
Phase (Design/Operation) design, operation (a) The software failure incident at the University of Maastricht was primarily due to a design-related factor. The initial breach that led to the ransomware attack was caused by an unidentified staff member clicking on a phishing email a month earlier. This indicates a vulnerability in the system design or security protocols that allowed the attack to occur [95993]. (b) Additionally, the operation of the system also played a role in the software failure incident. The ransomware attack unfolded on Dec. 24, indicating that the attack was able to penetrate the system and cause disruption in the operation of the university's computer systems, including email and computers [95993].
Boundary (Internal/External) within_system (a) within_system: The software failure incident at the University of Maastricht was primarily within the system. The initial breach occurred when an unidentified staff member clicked on a phishing email, which was an internal action that led to the compromise of the university's computer systems [95993]. Additionally, the decision to pay the ransom to unblock the systems was made internally by the university's leadership after considering the alternatives, such as rebuilding the IT network from scratch [95993].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident at the University of Maastricht was primarily due to non-human actions. The initial breach occurred when an unidentified staff member clicked on a phishing email, leading to the infiltration of the university's computer systems by the TA505 hacker group [95993]. The ransomware attack and subsequent blocking of computer systems were consequences of this non-human action. (b) Human actions also played a role in the software failure incident. The decision to pay the ransom of 30 bitcoin (equivalent to 200,000 euros) was made by the university's leadership after considering the alternatives, which included rebuilding the entire IT network from scratch. This decision was based on the impact on the work of students, scientists, staff, and the institution's continuity [95993].
Dimension (Hardware/Software) software (a) The software failure incident at the University of Maastricht was not directly attributed to hardware issues. The incident was a result of a ransomware attack where hackers blocked the university's computer systems, including email and computers, after an initial breach caused by a staff member clicking on a phishing email [95993]. (b) The software failure incident was primarily due to contributing factors originating in software, specifically the ransomware attack carried out by the TA505 criminal group. The attack led to the blocking of the university's computer systems, necessitating the payment of a ransom to unblock the systems [95993].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at the University of Maastricht was malicious in nature. It was a ransomware attack where hackers demanded a ransom of 30 bitcoin to unblock the university's computer systems, including email and computers. The attack was initiated by a phishing email clicked on by an unidentified staff member, leading to the breach by the Russian-speaking criminal group TA505 [95993].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions. The University of Maastricht disclosed that the ransomware attack, which led to the payment of a ransom to hackers, originated from an unidentified staff member clicking on a phishing email a month earlier. This action of clicking on the phishing email was a poor decision that ultimately led to the breach and subsequent ransom payment [95993].
Capability (Incompetence/Accidental) accidental (a) The software failure incident at the University of Maastricht was not attributed to development incompetence. Instead, it was caused by a staff member clicking on a phishing email, leading to the initial breach that allowed the hackers to infiltrate the university's systems [95993]. (b) The software failure incident at the University of Maastricht can be categorized as an accidental failure. The breach occurred when an unidentified staff member accidentally clicked on a phishing email, which ultimately led to the ransomware attack and the subsequent need to pay a ransom to unblock the computer systems [95993].
Duration temporary The software failure incident at the University of Maastricht was temporary in nature. The incident involved a ransomware attack that blocked the university's computer systems, including email and computers, after an attack on December 24. The university decided to pay the ransom to unblock the systems, indicating that the failure was temporary and could be resolved by taking specific actions [95993].
Behaviour other (a) crash: The software failure incident in the article is not described as a crash where the system loses state and does not perform any of its intended functions [95993]. (b) omission: The failure is not attributed to the system omitting to perform its intended functions at an instance(s) [95993]. (c) timing: The incident is not related to the system performing its intended functions correctly but too late or too early [95993]. (d) value: The failure is not due to the system performing its intended functions incorrectly [95993]. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions [95993]. (f) other: The behavior of the software failure incident in the article is related to a ransomware attack that blocked the university's computer systems, including email and computers, after an initial breach caused by a staff member clicking on a phishing email. The incident led to the university paying a ransom to unblock its systems, highlighting the impact of cyber attacks on institutions [95993].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident at the University of Maastricht involved a ransomware attack where hackers demanded a ransom of 30 bitcoin (equivalent to 200,000 euros) to unblock the university's computer systems, including email and computers [95993]. The decision to pay the ransom was made to prevent further damage to the work of students, scientists, and staff, as well as to ensure the continuity of the institution [95993]. The attack resulted in significant financial impact on the university, as they had to pay a substantial amount to regain access to their systems and data.
Domain knowledge (a) The University of Maastricht's computer systems, including email and computers, were blocked due to a ransomware attack [95993]. (h) The University of Maastricht, being an educational institution, had its IT network affected by the ransomware attack, impacting the work of students, scientists, and staff [95993]. (m) The University of Maastricht, a higher education institution, was the target of the ransomware attack, which does not fall under the specific industries listed [95993].

Sources

Back to List