Maastricht University (UM), which is a Dutch university has reportedly recovered a ransom paid from a recent ransomware attack on its network in 2019. A cybersecurity company named Fox-IT performed a thorough investigation of the incident and liked the ransomware attack to a financially motivated hacker group TA505 known to primarily target retail and financial organizations since quarter 3 of 2014.
According to the university they have reported to pay the amount of ransom in turn of getting their valuable files decrypted on December 30. The UM has paid approximately 30 bitcoin of ransom for the ransomware decryptor in order to avoid delaying exams and losing important university valuables.
UM said, “It is a decision that was not taken lightly by the Executive Board. but it was also a decision that had to be made.” They further added, “We felt, in consultation with our management and our supervisory bodies, that we could not make any other responsible choice when considering the interests of our students and staff.”
According to the university reports, the Netherlands’ Public Prosecution Service has traced and seized a wallet containing the ransom paid in cryptocurrency by UM in 2019. To which UM said, “The investigation [..] eventually paved the way for the seizure of the cryptocurrency by the Dutch Public Prosecution Service. As early as February 2020, the investigation team froze a so-called wallet containing part of the paid ransom.”
They added, “The value of the cryptocurrencies found at that time was €40,000; at the current exchange rate, they are worth approximately €500,000.”
However, according to the reports presented by the university supposedly UM has made a profit from the cryptocurrency wallet seized by law enforcement agents. The profit has sufficed the financial loss that UM has to face during the cyber attack. The Netherlands’ Public Prosecution Service and the Ministry of Justice have already started the legal process of transferring the amount to the university.
