Review of cyber crisis exercise OZON 2025

On Thursday 27 March, we at the University of Groningen found ourselves in the middle of an intense situation... What started with messages on social media about a planned demonstration, soon led to a full-blown cyber crisis!

Activists forced their way into the exam hall and even attempted to start a fire. At the same time, we were confronted with a DDoS attack and reports of data breaches involving sensitive personal data or research data. To top it all off, we were put under a lot of pressure by the media. This was a horror scenario that tested our crisis teams to the limit.

Sector-wide cyber crisis exercise

Rest assured, this fortunately did not really happen! It is the scenario of SURF's large-scale cyber crisis exercise OZON2025, where we worked with ninety other educational and research institutions to test our resilience in the event of a cyber crisis.

Testing resilience

The aim? To test how well prepared we are for a cyber crisis. Although this was an exercise, the stressful moments felt very real. This exercise not only helped us to test our own processes, but also to learn from each other and further improve our approach. Participation in OZON allowed us not only to test our own procedures, but also to gain insights from the experiences of other SURF institutions. This joint approach strengthens our sector-wide resilience to cyber incidents.