5 Colleges That Suffered a Data Breach, and What to Learn From Them

Higher Education institutions must also be aware of Federal Laws, such as the Family Education Rights & Privacy Act (FERPA). FERPA allows current and former students inspect, amend and have some control over the disclosure of their records. It is applied to all schools that are in receipt of Federal Funding. Recent legislation has been proposed to amend FERPA, including:

o Require schools to maintain and make available a list of all outside companies that have access to their students’ information.

o Give parents the right to review and correct personal information collected about their children by educational apps, online homework software or any other school vendors.

o Minimize the amount of students’ personal details that schools could transfer to other companies.

o Prohibit the use of students’ personal information to market products or services to them.

o Require data security safeguards to protect sensitive student data collected by companies.

Educational institutions will remain high on the data breach target list as personal information stored is robust and often times held for many years. The lack of internal security protocols, disjointed IT operations and a general misunderstanding of data vulnerabilities put personal information at risk.

It is time for universities to protect their data like businesses and engage in risk assessments and educational tools to protect them from the inevitable.

John Farley, Vice President and Cyber Risk Practice Leader at Hub International, has 23 years of experience in insurance and risk management. He leads Hub’s growing Cyber Risk division of consultants and brokers focused on assisting clients with achieving their risk improvement goals, providing advisory services and serving as a network security and privacy liability consultant. He helps clients with pre and post data breach services, applying his extensive knowledge in data breach response.