Good day. Maastricht University fell victim to a ransomware attack in December and hired an outside security firm to study what went wrong. As WSJ Pro’s Catherine Stupp reports, several missteps hampered the institution’s ability to deal with the incident, including the information-technology staff’s inadequate focus on alerts about suspicious activity. Companies can learn from what investigators found.

Other news: U.S. prosecutors hit Huawei with racketeering charges, and a federal trial of a former CIA software engineer provides a glimpse of spy-agency culture.

Readers: We won’t publish a newsletter on Monday in observance of Presidents Day in the U.S. We will be back on Tuesday.

Common IT problems hampered Dutch university’s response to hackers. Technology administrators at Maastricht University, a public institution with around 19,000 students, failed to stop a ransomware attack in late December, according to experts who studied the incident. All university systems, including email, were down from Dec. 23 until Jan. 6.

IT staff had received alerts about phishing emails in the weeks before the outage but didn’t investigate properly, and the university didn't have sufficient tools to monitor the network for attacks, experts found.

The university paid a ransom of almost €200,000 ($217,000) in bitcoin last month to decrypt its files. The attack holds useful lessons for businesses about limiting the mobility of attackers, dealing with tons of alerts and—perennial favorite—patching.

Read the full article.

“We need more people, new technology….We need some more advanced tooling than we have right now,” said Michiel Borgers, CIO at Maastricht University.

Lessons from a forensic investigation into a ransomware attack on the university include the following:

Huawei charged with racketeering. Federal prosecutors in Brooklyn, N.Y., accused Huawei Technologies Co. and two U.S. subsidiaries of stealing trade secrets, The Wall Street Journal reports. The indictment, unsealed Thursday, builds on allegations the U.S. leveled in January 2019 accusing the company of financial fraud. Huawei has obtained nonpublic intellectual property about robotics, cellular-antenna technology and internet router source code, prosecutors charge.

Response: A lawyer representing Huawei and a company spokesman didn’t respond to requests for comment. Huawei has said it doesn’t spy for any government and is committed to complying with laws in global markets.

One scenario: Huawei unofficially operated a company called Skycom Tech Co. to obtain goods and technology from the U.S. for use in Iran in violation of American sanctions, according to the indictment.

CIA programmers describe spy agency subculture of Nerf guns, office drama. Testimony at the espionage trial of Joshua Adam Schulte, a former engineer at the Central Intelligence Agency, opens a rare window into the daily life of the organization’s software group, the Journal reports.

You may recall: In March 2017, WikiLeaks exposed some of the work of CIA programmers with top-secret security clearances building hacking tools to penetrate the computer networks of foreign governments and adversaries. The incident led to espionage and other charges against Mr. Schulte, 31.

Keeping secrets: To address concerns about state secrets being divulged in open court, U.S. District Judge Paul A. Crotty has allowed CIA employees to testify under pseudonyms or first names only. Two news reporters can enter the sealed courtroom at a time but can’t describe or sketch witnesses.

Office darts: Mr. Schulte had an “extremely strained” relationship with a colleague identified in court as Amol, according to one witness. A defense lawyer pressed the witness about the group’s culture, describing it as male-dominated, with abundant pranks and name-calling. The lawyer asked the witness at one point to confirm that Amol was annoyed by Mr. Schulte’s Nerf guns and would “take the Nerf darts and hide them.”

On it goes: Mr. Schulte has pleaded not guilty to all 11 criminal counts. The trial is expected to last one month.

Write to the WSJ Pro Cybersecurity Team: Kim S. Nash, James Rundle and Catherine Stupp.

Follow us on Twitter: @knash99, @JimRundle and @catstupp. Also, @WSJCyber.

Contact Enterprise Technology Editor Steve Rosenbush at steven.rosenbush@wsj.com or follow him on Twitter: @Steve_Rosenbush.