Education breaches cost $3.80M. The closure risk is real.

Educational records contain a payload that is unusual in scope and longevity. A K-12 student record may include SSN, family financial information (for free-lunch eligibility determination), disciplinary history, special-education evaluations including IEP and Section 504 plans, school health-services records, and contact details for parents and emergency contacts. A college student record adds financial-aid history, transcripts, disability-services accommodations, mental-health-services counselling notes, and on-campus housing records. Faculty and staff records add the standard employment data plus research-grant intellectual property and clinical-practice billing for academic medical centres.

The longevity is the unique stressor. An SSN exposed in a college freshman's registrar record at age 18 is the same SSN that person uses to apply for a mortgage at 35. The exposure has a 40-plus-year tail. Behavioural-health counselling notes from a college mental-health clinic can resurface in a custody dispute 20 years later. Schools therefore carry an obligation, both ethical and increasingly legal, to retain protection long after the affected individual has left the institution.

The IT estate that has to bear that obligation is typically a mix of long-tail legacy systems (campus student-information system from the 2000s, residence-life database, financial-aid system, library-management system, learning-management system, alumni-relations system) each with its own authentication architecture and patch cadence. Consolidation programmes have been underway for 15 years but most institutions still operate dozens of distinct authentication zones, which is why credential-stuffing and lateral-movement attacks are disproportionately successful in education.

The Family Educational Rights and Privacy Act (FERPA) is the federal statute governing access to education records. FERPA itself does not provide a breach-notification timeline or a per-violation penalty. The only sanction available under FERPA is the withholding of federal funding, which the Department of Education has never imposed in the statute's 50-year history. The practical effect is that FERPA breach cost flows through state breach-notification laws, contractual obligations to families, and reputational damage rather than through federal penalty.

COPPA (Children's Online Privacy Protection Act) governs personal information collected from children under 13 and is enforced by the FTC with civil penalties up to $51,744 per violation (2025 inflation-adjusted figure). State student-privacy statutes provide additional teeth. California's SOPIPA applies to K-12 service providers, with state AG enforcement authority. Illinois's SOPPA, New York's Ed Law 2-d, and similar statutes in 15+ other states create a patchwork that K-12 districts have to navigate when a breach affects students across state lines (common in cloud-based learning-management systems).

For higher-education institutions, the additional regulatory layer is the Gramm-Leach-Bliley Act, which applies to financial-aid functions and was extended by the FTC's Safeguards Rule revision in 2023. The revised rule requires designated qualified individuals, written incident response plans, encryption of customer information, multi-factor authentication, and regular penetration testing. Compliance cost runs $50K to $500K annually for a mid-sized institution and rises sharply post-breach.

Education IT budgets are persistently below the equivalent in other sectors. EDUCAUSE Core Data Service figures put the median higher-education central IT budget at 3.5% to 5% of total institutional operating budget, against 7% to 12% for financial services and 4% to 6% for healthcare. The security-specific allocation within IT runs 8% to 14% of IT budget for higher education, against 12% to 20% for financial services. The arithmetic is unforgiving: the institution that has to defend the longest-tail data exposure does so on the smallest relative budget.

The structural fix is consolidation and managed services. State higher-education systems that have moved to consolidated SOC operations across a system office report 30% to 50% reductions in mean time to detect, with corresponding reductions in expected breach cost. The single highest-leverage control investment for a small institution remains MFA enforcement on every account, with verified IBM saving of $800K against an annual cost of around $25K per employee for a managed identity service.