TU Delft moved student data, medical records to U.S. contractor's cloud without cleanup

Delft University of Technology moved personal records on more than 267,000 students and alumni to the cloud in November 2025 without copying records that should have been deleted, an investigation by the camous magazine Delta found. Medical statements were among the files copied into a system the supplier Caci BV, the Dutch subsidiary of U.S. defense contractor Caci International, could now open without getting the university permission.

The university had reportedly known prior to the migration that its student information system, Osiris, still held records past their legal retention periods. According to Delta, internal advisers, the works council, and the university's own data protection officer had urged a cleanup. TU Delft did not do so on a large scale. Privacy experts that spoke to Delta called the decision negligent and a violation of European data protection law.

“If you have 267,000 people in your database, you are supposed to take the time to clean things up systematically,” Bart Jacobs, a professor of digital security at Radbound University, told Delta. “Especially in light of the major data breaches of recent times, such as those at Clinical Diagnostics and Odido, such negligence is unacceptable and irresponsible."

The university could face a fine from the Dutch Data Protection Authority if a complaint is filed, Jacobs said. This is because the university had breached the General Data Protection Regulation and the rights of the people in the databases.

Before the move, supplier Caci BV could open student files only with TU Delft’s permission, usually during an outage. Now that the information is in the cloud, the company can reach it on its own. Cybersecurity specialist Bert Hubert described the shift to Delta as the difference between keeping records in your own vault and placing them in the supplier’s.

Caci BV is a subsidiary of Caci International Inc., a U.S. company. In 2025, 75 percent of Caci International’s 8.6 billion dollars in revenue came from U.S. Defense Department contracts, including work for military intelligence agencies. Caci BV director Susanne Zuurendonk told Delta she places high value on the independence of the schools that use Osiris.

Osiris is used by Dutch universities to track its students from application to graduation. It holds addresses, grades, and citizen service numbers, as well as bank account numbers. Diplomas and transcripts can be kept in the system for up to 30 years.

The system also stored medical information, Delta found. If a student wants to apply for extra time, for example, they need to provide a document with their diagnosis, such as dyslexia. Delta reviewed a screenshot of a student file in which a document called dyslexieverklering.pdf was visible to staff.

Health data is subjected to stricter rules under the GDPR. The university’s Data Protection Impact Assessment, a required privacy review of the cloud move, said Osisris is not meant for health records and that such information is not stored there “in principle.”

“Medical information always raises the risk level of a system," David Groep, a professor of e-infrastructure at Maastricht University, told Delta. “I would never store this in an educational administration system.” He told the newspaper that the university should have only kept a reference number in Osiris and stored the file locally.