Maastricht University Clop ransomware (Netherlands, 2019)
TA505 used Clop ransomware to encrypt 267 Maastricht University servers over Christmas 2019 after two phishing emails on 15–16 October had compromised the network. The university paid 30 BTC (~$220,000). The ransom Bitcoin — later seized from a money mule — was returned and had appreciated, leaving the university ahead by ~$300,000.
- Victim
- Maastricht University
- Loss
- $220.0K
In December 2019, Maastricht University in the Netherlands suffered a Clop ransomware attack delivered by the TA505 crew. The encryption hit at one of the worst possible times — 23 December, just as students and most staff were leaving for Christmas — and shut down 267 servers including backups. The university paid 30 BTC (~$220,000) on 30 December to restore operations.
What happened
The intrusion started small. On 15 October 2019 two phishing emails were sent to university staff; one was opened, and TA505 had its foothold. Over the next five weeks the attackers moved laterally through the network. On 21 November, they gained admin rights on an unpatched server — a single missing patch on a single host. That box became the pivot from which Clop ransomware spread to 267 Windows servers, including the backup infrastructure.
Detection came on 23 December. Fox-IT was engaged for forensics. The university weighed two options: pay the ransom or rebuild every affected system from scratch with no guarantee of timeline. After a week of analysis the university paid 30 BTC (~$220,000) on 30 December.
The case had an unusual coda. Dutch police later seized a portion of the ransom Bitcoin from a money mule. By the time the funds were returned to the university in July 2022, Bitcoin had appreciated enough that the university ended up roughly $300,000 ahead of its original payment.
Impact
- 267 servers encrypted, including backups.
- ~$220,000 ransom paid.
- Operations restored within days of payment.
- Root cause: a single unpatched server.
- Coda: Dutch police seized a portion of the Bitcoin; appreciation left the university with a net profit on the ransom payment.
Why it matters
Maastricht University is a textbook public-sector ransomware case: a single unpatched host enabled lateral movement to backup servers, removing the "restore from backup" option. The Fox-IT report has been cited widely in European higher-education security planning. The Bitcoin-recovery coda — paying a criminal in Bitcoin and ending up ahead — is also one of cybercrime's stranger outcomes.
Financial impact
Reported costs in USD
- Ransom paid$220.0K
Timeline
Two phishing emails reach Maastricht University staff; one is opened. TA505 establishes initial access.
Attackers move laterally through the network; on 21 November they gain administrative rights on an unpatched machine.
Clop ransomware encrypts 267 of the university's Windows servers, including backups.
After weighing options including rebuilding from scratch, Maastricht pays 30 BTC (~$220,000).
Fox-IT publishes its investigation: a single unpatched server was the pivot point that allowed the malware to spread to all 267 affected machines.
A portion of the Bitcoin ransom — earlier seized by Dutch police from a money mule — is returned to the university. Bitcoin appreciation means the university ends up roughly $300,000 ahead of the original payment.
Sources
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/ta505-hackers-behind-maastricht-university-ransomware-attack/
- securityweek.comhttps://www.securityweek.com/netherlands-university-pays-240000-after-targeted-ransomware-attack/
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/maastricht-university-wound-up-earning-money-from-its-ransom-payment/
- fortune.comhttps://fortune.com/2022/07/06/university-of-maastricht-recovered-bitcoin-paid-in-ransomware-attackand-worth-510000-twice-value-at-time/
- grahamcluley.comhttps://grahamcluley.com/dutch-university-ransomware/