Some have called higher education institutions the “center of the bulls-eye” when it comes to data breach targets. That’s probably a bit too dramatic. Just a bit.
Higher ed institutions need their networks to be accessible by large numbers of students and faculty members across a broad range of locations. Students and professors produce and consume an enormous volume of electronic data. And schools store the good stuff – think financial, medical and personally identifiable information. The combination of perceived vulnerability and valuable information is kind of a perfect storm.
And the storm has officially made landfall. Richard Perez-Pena, of the New York Times, did a nice job covering this climate change in his 2013 article, “Universities Face a Rising Barrage of Cyberattacks.” Perez-Pena reported that the University of Wisconsin was seeing 90,000 – 100,000 hacking attempts per day. Berkeley reported millions of attempts per week. He notes that these institutions, between student and faculty data and research, are “among the most open and robust centers of information exchange in the world.” Open and robust is a good thing, right?
Most hacking attempts are not successful. But an alarmingly increasing number of them are. In 2014, it’s been reported that the University of Maryland, North Dakota University, Butler University and Indiana University all suffered “mega breaches,” attacks compromising over 100,000 records. Over 25 other schools reported smaller breaches, including our own Penn State. These breaches were a case of the hiccups compared to the 2011 breach at Maricopa County Community College. Over 2 million records were compromised. A class action lawsuit sought $2,500 per affected person. That’s claimed damages over $5 billion. With a “B.”
Remarkably, many schools still do not have data privacy insurance. Some cite cost as a factor, but coverage is generally more affordable than most assume. More importantly, data breach coverage has officially become one of those things that even if you can’t afford it, you really can’t afford not to have it. Like, um, commercial general liability insurance. Or directors and officers insurance. And…well, I think you get my drift.