In the recent cyberattack that was forced to shut down the server of the Dutch Research Council (NWO) and stops all the processes and services running in the organization. The NWO confirms that they are the victim of a ransomware attack which is initiated by the DoppelPaymer ransomware gang.

The attackers also gained the access to NWO’s network and steal all the confidential documents and then threatening the organization to pay a ransom or they will leak the data.

Why DoppelPaymer Flowed the Data?

The NWO does not pay the ransom, therefore they leaked the data as proof of stolen on their internal site. Using these techniques the ransomware gangs apply pressure on the victims while paying the ransom.

NWO is working as the main body, they provide funds for researchers to the multiple universities and institutes located in the Netherlands, which is about 1 billion euros annually.

The DoppelPaymer ransomware gang disclosed millions of stolen files, to show that they have the data and they are still ready for the negotiations.

Whereas the NWO said that the attackers have the internal information and these include the employee’s details but this will not going to change the decision not to pay the ransom.

What NWO is Executing?

NWO is now working on restoring their data present on the network as the system files are encrypted and these backup operations are taking the time of few weeks. Whereas, the FAQ from the company says that the cyber attack impacted the network disk and the data the was processed by NWO, the NWO-I office, the National Governing Body used for Practice-oriented Research SIA, and the Netherlands Initiative For Education and Research.

Multiple other organizations that used the same network servers present in the NRO steering body, TKI-HTSM, TKI Chemie, European Polar Board, and LNVH are also infected by this attack.

The UKRI agency termed UK Research and Innovation also executes the same mission that NWO works and UKRI was hit by the ransomware attack in January that encrypted the data and their services.

NWO has lots of work while restoring their data and services. UKRI also announced that they successfully restored their services and Users will have to update their passwords while logging into the company panel.