Cyberattacks on high-profile companies such as Target and The Home Depot have driven a growing number of school CIOs and administrators to purchase cyber insurance policies in attempts to avoid costly litigation from a data breach.
Such policies protect digital and print data, such as student and staff social security numbers, addresses and payroll. The insurance often covers notification and investigation costs, legal assistance, and sometimes media relations after a breach.
“When you think about the kind of data schools hold for employees and students, it’s a fertile ground for hackers,” says Trudy Sowar, director of risk-management services for the Georgia School Boards Association and former superintendent of Paulding County Public Schools.
About 10 years ago, Paulding County, located about 30 miles west of Atlanta, fell victim to a phishing scam from Russia. A man walked into a bank used by the district and withdrew tens of thousands of dollars from the payroll account using the district’s password, Sowar says. The bank refunded most of the money, though it was not obligated to do so, she adds.
The Georgia School Boards Association began offering all of its districts a group cyber insurance plan about three years ago. This year, 59 out of the 95 districts in the association opted to pay for the insurance, at about $1 per student.
“Not a day goes by when you don’t hear more about cyber breaches,” Sowar says. “It’s a very inexpensive way to help be prepared, should you have a loss.”
Protecting premium information
It is unknown how many public schools purchased cyber insurance in 2015-16. According to insurance broker Marsh in its recent report “Benchmarking Trends: Cyber Attacks Drive Insurance Purchases for New and Existing Buyers,” client spending on standalone cyber insurance increased 32 percent for the first half of 2015.
Universities and other education-based institutions saw a growth rate of 155 percent, it states.
Ann Arbor Public Schools, a district of 17,000 students in Michigan, started buying cyber insurance coverage three years ago.
“As a district, our funds are tight, and we did not want to take the chance of an information breach that someone could sue the district over,” says Judy Solowczuk, Ann Arbor’s executive assistant for finance and operations. “We felt it was less expensive to purchase the insurance than to pay out millions over a breach of information if that should happen.”
Last year, Ann Arbor paid $25,100 for the cyber insurance policy, which covers the cost of court proceedings related to a data breach. The district’s property and flood insurance costs nearly $800,000. “When you think about a lawsuit or a cyber breach, that’s a drop in the bucket,” Solowczuk says.
The district has not suffered an online security breach. “Personal information is a premium,” Solowczuk says, “and we need to protect it in the best way we know how.”
