KNVB paid ransom to prevent cyber criminals from publishing footballers' passports

The Dutch football association KNVB paid the ransom demanded by cyber criminals in a ransomware attack in April. The hackers stole Dutch and other football players’ passports, ID cards, home addresses, and salary slips and threatened to publish the data if the football association didn’t pay the ransom, the KNVB said on Tuesday.

“Investigation could not reveal which data had actually been captured or accessed,” the KNVB said. “That presented us with a dilemma without an option that we felt comfortable with. Preventing such a leak ultimately outweighed the principle of not allowing ourselves to be extorted.”

The cybercriminals had access to hundreds of gigabytes of files. In addition to passports and payslips, they also took medical data from people who had contact with the KNVB Sports Medical Center.

The KNVB will inform everyone affected by the leak. The football association hopes that paying the ransom ensured that the cybercriminals would not leak the stolen data. But it cannot guarantee that, so it will notify all victims.

The Dutch football association didn’t say how much it paid in ransom. According to RTL Nieuws, it was over a million euros. Lockbit, a group of cybercriminals with links to Russia, claimed the attack, the broadcaster wrote.