College and universities, like many other businesses and organizations, defend against millions of cyberattacks each day. Most recently, Penn State’s College of Engineering discovered a multi-year long cyberattack seeking usernames and passwords of students, faculty, and staff. The University hired consultant Mandiant to investigate the breach. Mandiant discovered two separate attackers and determined that at least one was from China.

Hackers often target colleges and universities because they are rich sources of information. First, large universities have personal information files on thousands of individuals – students, faculty, and staff members. Additionally, the university likely has personal financial data for tuition payments and ticket sales. Most significantly, however, universities have valuable intellectual property and technology research files, the result of work by professors, graduate students and their sponsoring company collaborators. Much of the research is not yet protected by patent filings and so is very vulnerable to theft.

Because of Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99), a federal law that protects the privacy of student’s personal information, higher educational institutions have policies and practices in place to educate and safeguard against the transfer of student data. However, these efforts have not generally focused on defending against a cyberattack. Additionally, the organizations also have a large number of users with password protected access to some or all of their IT systems, and thus hackers have many opportunities to exploit vulnerabilities in the system to gain access.