Cybersecurity Policy Report, University Fined Over GDPR Violations in Netherlands, (Dec 17, 2025)
The Dutch data protection authority, Autoriteit Persoonsgegevens (AP), has announced that it has fined HAN University of Applied Sciences for violating the European Union’s General Data Protection Regulation (GDPR) by failing to take sufficient measures to properly protect the personal data of employees and students.
HAN University reported to AP in 2021 that a hacker had “gained access to the educational institution's web server and database server via a web form” and was able to gather addresses, names in combination with passwords, and citizen service numbers, the AP said in a news release.
The hacker threatened to disclose the data to the public and demanded a ransom, which the university did not pay, the AP said.
An investigation was launched after the breach and the AP determined that the digital security of the servers that HAN used were “insufficiently geared toward the risks,” and the access rights of a user on the database server had no restrictions, which created a vulnerability in which a “single application on the web server could have led to access to all data on the database server.”
The AP notes that the data breach itself does not constitute a violation of the GDPR, but the lack of sufficient security measures designed to protect the personal data on the servers was a violation.
For the violation, the AP fined HAN 175,000 euros ($205,000) after considering the fact that HAN implemented remedial measures and “actively worked to map the consequences for data subjects and mitigate them where possible.”
News: InternationalLegislation DataPrivacy DataBreach GDPR LitigationEnforcement