The personal data of an untold number of students at VU University in Amsterdam is on the street after a laptop is stolen from the university. The stolen computer contained demographic data of students enrolled between 2003 and 2019.
Two laptops were stolen during the campus burglary in late November. One of the laptops contained copies of the passports and residence permits of an unknown number of students, the VU.
In addition to personal data, the laptop may also contain lists of grades, information about payment arrears or correspondence about objections to exam results.
The university has sent an email to all alumni who enrolled between 2003 and 2008 in a doctoral, bachelor’s, or master’s degree program. It also concerns the data of students who have attempted to enrol.
Another group of students whose data is on their laptops are international students who enrolled between 2008 and 2015. This group may also have had identity data and correspondence on laptop objections.
The last group that has been contacted are students who attended a secondary subject at VU between 2008 and 2009 or who had a previous education. Exam results and certificates obtained by this group may be leaked.
The laptops have not been encrypted, the data has not been erased
According to the VU, the stolen laptops were not part of a “single deal” within the ICT system. As a result, they don’t have the standard security and encryption installed on regular school PCs. For this reason, personal data has also not been deleted.
The university has announced that an investigation has been launched into the extent of the data breach. We also monitor whether alumni data appears online. Malicious individuals may be able to commit identity fraud with the data.
The Executive Council speaks of an “unfortunate combination of circumstances” and has opened a special helpline for students who fear they may be victims of the leak.
The VU reported the theft to the Dutch data protection authority.
