# A Systematic Review of Cybersecurity Risks in Higher Education
## 6 Cyber Threat Events in HE
### Publications on Data Breaches and Threat Events  
The analysis of the PRC data on breaches at universities and colleges in the US from 2005-2009 by [PERSON] and [PERSON] [2] applied broad categorization of incidents. As seen in Table 7, \"Hacker\" incidents are the most frequent. The authors defined the category \"Hacker\" as _unauthorized remote computer break-ins\"_. These incidents make out 38% of the total 290 recorded incidents. Other frequent incidents were \"Exposed\" (28%) which the authors defined as _\"unprotected data that may be publicly accessible and includes records  
Figure 2: Incident causes in the Norwegian University SOC, histogram from Wangen [9]. exposed in an e-mail, regular mail, online and through disposal.\"_, and \"Stolen\" which refers to stolen equipment. [PERSON] and [PERSON] [51] polled their participants regarding cyberattacks, and found that the most common cyber threat in the Ghanaian University was \"Malware\", with only 14.5% of the participants reporting that they had never suffered a malware incident. 63% of the respondents reported never to have been targeted by online fraud, scams or phishing attacks. About 70% reported never to have suffered identity theft, impersonation, or password theft. Furthermore, two of the included literature sources also use the PRC Chronology of Data Breaches and classifications for their analysis: Grama [60] included 562 reported breaches at 324 unique institutions in the US between 2005 to 2013, \(n=551\). 63% of all breaches were reported from doctoral level institutions, making up approximately 7% of all US institutions. As previously described, [PERSON] enriched the same dataset from 2005-2014 with findings additional analysis, but retaining the same classifications, \(n=604\). A comparison of these results is presented in Table 8. Although, all three sources emerge from PRC, the categorization is different in Table 7 than in Table 8.  
The largest proportion of the reported breaches in the Table fell into the \"Hacking/malware\" classification, which accounts for 36% and 39% of all breaches, similar to the findings by [PERSON] and [PERSON] [2]. Grama reports that these breaches were outside parties accessing records via direct entry, malware, or spyware. The second largest category of reported breaches was the result of \"Unintended Disclosures\", which is similar to the \"Exposed\" category proposed by [2]. Finally, the third-largest proportion was caused by the loss of a portable device, which is similar to \"Stolen\" and \"Missing \" in Table 7. \"Payment Card Fraud\" was the least likely data breach classification seen among the reported breaches at higher education institutions [53; 60]. Only one breach was classified with this tag, which occurred in 2012. Furthermore, [PERSON] writes that potential direct financial costs of a data breach in higher education could include legal representation, fines, and the expense of notifying affected individuals. He continued to address that organizations like higher education might face, losses in reputation and consumer confidence. Defacement and reputational consequences could result in a loss of alumni donations and even a reduction in the number of students choosing to apply to or attend the institution. We have included the annual _Data Breach Investigation Report_ by the commercial vendor Verizon from 2017-2020 [61; 62; 63; 64]. The Verizon 2020 report found 819 and 228 confirmed data disclosures in the educational service. For 2019, 382 incidents with 99 were confirmed data disclosures; 2018 had 292/101, and 2017 had a 455/73 ratio. The numbers are broken down in the \"Industry comparison\" where Verizon categorizes the incidents in \"Actions\". The Table 9 illustrates breaches occurring in the year 2017, 2018, 2019 and 2020 systematized into six categories with the corresponding distribution.