An interesting discussion of the repurcussions of a hack at Ohio University in May was discussed by Adam Dodge yesterday. 

“The computer system contained biographical information for more than 300,000 individuals and organizations, including the Social Security numbers of more than 137,000 individuals” was penetrated by unknown persons. A later report indicated that another breach exposed the Social Security numbers and also health records of “60,000 people including all current students as well as some school faculty.”

There are many studies about how organizations can lose customers following an incident.  Funding for universities typically comes from a wide range of sources, such as alumni donations, grants, etc.  This article is interesting in that it talks about some of the reactions from alumni and students.  What's also interesting about this is that this incident occurred from a hack into the university's computer system...a laptop wasn't lost, backup tapes weren't stolen, or some other general end-user error.  From what I understand from what has been reported the hack was possible because of inadequate security on the system.  As a result, as the article states, the university has suffered:

• Negative publicity and resulting loss of trust and damaged reputation
• Threats of lawsuits
• Lost donations
• General rants and complaints
• Bills for the time spent to check credit reports

A few other impacts not stated in the article that will likely, or at least could, occur include:

• Large legal fees to address the lawsuits
• Potential regulatory noncompliance findings
• The potential fines, penalties and other judgments
• Costs to hire more personnel to handle the fallout (phone calls, letters, reporter questons, etc.)
• Upgrading systems to make them more secure (which should have been done to begin with) and implementing additional safeguards
• Increased PR efforts to counteract the impacts from the first list
• Lost students and potential students
• Lost faculty and employees
• Lost funding, grants and other revenues educational institutions rely upon as part of their total funding
• Increased insurance premiums for the various types of liability and other risk insurance that universities carry
• Potentially having programs and classes cut because of the overall impact of the revenue loss and other impact costs
• And probably several others...

There are always important lessons to learn from the pain, misfortune and incidents of others.  It's better, in all ways, to prevent bad things from happening, at least doing everything you can and showing due diligence to prevent bad things, than to wait until after an incident occurs.

Technorati Tags
information security
IT compliance
regulatory compliance
incident impact
hacker
policies and procedures
awareness and training
privacy