Education breaches cost $4.15M. The closure risk is real.

Educational records contain a payload that is unusual in scope and longevity. A K-12 student record may include SSN, family financial information (for free-lunch eligibility determination), disciplinary history, special-education evaluations including IEP and Section 504 plans, school health-services records, and contact details for parents and emergency contacts. A college student record adds financial-aid history, transcripts, disability-services accommodations, mental-health-services counselling notes, and on-campus housing records. Faculty and staff records add the standard employment data plus research-grant intellectual property and clinical-practice billing for academic medical centres.

The longevity is the unique stressor. An SSN exposed in a college freshman's registrar record at age 18 is the same SSN that person uses to apply for a mortgage at 35. The exposure has a 40-plus-year tail. Behavioural-health counselling notes from a college mental-health clinic can resurface in a custody dispute 20 years later. Schools therefore carry an obligation, both ethical and increasingly legal, to retain protection long after the affected individual has left the institution.

The IT estate that has to bear that obligation is typically a mix of long-tail legacy systems (campus student-information system from the 2000s, residence-life database, financial-aid system, library-management system, learning-management system, alumni-relations system) each with its own authentication architecture and patch cadence. Consolidation programmes have been underway for 15 years but most institutions still operate dozens of distinct authentication zones, which is why credential-stuffing and lateral-movement attacks are disproportionately successful in education.

The Family Educational Rights and Privacy Act (FERPA) is the federal statute governing access to education records. FERPA itself does not provide a breach-notification timeline or a per-violation penalty. The only sanction available under FERPA is the withholding of federal funding, which the Department of Education has never imposed in the statute's 50-year history. The practical effect is that FERPA breach cost flows through state breach-notification laws, contractual obligations to families, and reputational damage rather than through federal penalty.

COPPA (Children's Online Privacy Protection Act) governs personal information collected from children under 13 and is enforced by the FTC. The FTC's own COPPA guidance states that a court can hold an operator liable for civil penalties of up to $53,088 per violation. That ceiling took effect on 17 January 2025 and still stands: the 2026 inflation adjustment was cancelled when the Bureau of Labor Statistics could not produce the October 2025 CPI-U figure the formula depends on, so agencies carried the 2025 amounts forward unchanged. State student-privacy statutes provide additional teeth. California's SOPIPA applies to K-12 service providers, with state AG enforcement authority. Illinois's SOPPA, New York's Ed Law 2-d, and similar statutes in 15+ other states create a patchwork that K-12 districts have to navigate when a breach affects students across state lines (common in cloud-based learning-management systems).

For higher-education institutions, the additional regulatory layer is the Gramm-Leach-Bliley Act, which applies to financial-aid functions and was extended by the FTC's Safeguards Rule revision in 2023. The revised rule requires designated qualified individuals, written incident response plans, encryption of customer information, multi-factor authentication, and regular penetration testing. No regulator or sector body publishes a compliance-cost series for institutions subject to it, so we quote no figure; the cost drivers are the ones the rule names, and the largest of them for a smaller institution is usually the penetration-testing and continuous-monitoring obligation rather than the documentation.

Higher-education IT budgets are thin in absolute terms, and the sustained benchmarking series for them is the EDUCAUSE Core Data Service, which has reported central IT spending at around 4% of total institutional expenditure, with community colleges higher and public doctoral institutions lower. Two cautions on that number, because it gets stretched further than it supports. The full CDS dataset is available to participating members, so the published figures that circulate are summaries rather than the underlying series. And EDUCAUSE surveys higher education only: it publishes no equivalent ratio for financial services or healthcare, so the cross-sector IT-budget comparison often attributed to it does not exist, and neither does a published security-share-of-IT-budget comparison between those sectors. The honest version of the argument does not need one. The institution carrying the longest-tail data exposure in the portfolio is also the one with the least elastic budget, because tuition and appropriation revenue do not flex with incident response the way a bank's does.

Where IBM's 2026 data does speak directly is on who finds the breach, and it favours buying detection capacity rather than building it. Breaches identified by a managed security service provider averaged $4.86M, the cheapest of the three routes and 2.6% below the $4.99M global average, against $5.01M when an in-house team found it and $5.12M when the organisation did not know until the attacker told them (Figure 15). MSSPs identified 31% of breaches in the study, close behind in-house teams at 38% (Figure 14). For an institution that cannot staff a round-the-clock SOC, that gap between $4.86M and $5.12M is the clearest quantified case for outsourcing monitoring.

The single highest-leverage control investment remains MFA enforcement on every account. IBM publishes no MFA-specific dollar saving, but compromised and stolen credentials are among the most common and most expensive breach root causes, and MFA is the fastest control to deploy against them. The cost is one of the few in this area with a real list price to work from: Microsoft publishes Entra ID P1, the tier carrying conditional access and MFA enforcement, at $7.00 per user per month on an annual commitment (microsoft.com list pricing, checked 4 October 2026), and sells discounted academic SKUs on top of that. Multiply by the accounts you actually need to cover rather than by headcount; most institutions license staff and administrative accounts first, which is where the credential risk concentrates.