By Bridie Smith
Keeping families’ sensitive, personal information safe from cyberattacks has become the top insurance risk for private schools in Australia, according to a global insurance broker.
AON Australia, which has more than 600 Australian private schools on its books, has named cyber risk as schools’ primary area of vulnerability, followed by mental health and social media, in its Independent Schools Risk Report.
The digital world was the common thread linking the top three areas of risk for private schools.Credit: Getty Images
For the first time in the decade that the broking firm has produced the report, child abuse allegations entered the top 10 risk areas for schools managing students’ online and real-world safety. In this context, the term child abuse includes abuse from fellow children or at the hands of adults.
AON national education director Andrew Leahy said this in part reflected the 2017 release of the report of the Royal Commission into Institutional Responses to Child Sexual Abuse. He said for many schools, getting insurance cover for child abuse was becoming “incredibly difficult”.
An increasingly complex digital environment was the common thread linking the top three areas of risk for private schools, with cyberattacks becoming an established threat schools could not ignore.
“You’ll never get in front of it,” Leahy said, adding that the nature of the information schools held made them vulnerable.
“Schools have a lot of personal, identifiable information,” he said. “They have names, addresses, dates of birth, potentially medical conditions or counselling records as well as school records. There’s a lot of information there, which is very sensitive.”
The “always on” expectations were a significant driver of mental health issues among students and staff, Leahy said, adding that a growing number of digital platforms, messaging apps and increased sophistication of AI had also compounded the risks schools had to manage.
In June, fake nude images of 50 female Bacchus Marsh Grammar students were generated using AI and put on Instagram and shared on Snapchat.
“The No.1 issue in dealing with students is social media,” principal Andrew Neal said. “One of the issues that we’re worried about is the capacity to cover off on harm caused by AI.”
Neal said the private co-ed school was hit “virtually every day” with ransomware attacks, an experience echoed by Yarra Valley Grammar principal Dr Mark Merry.
He said the school employed an external company to conduct penetration tests on the school’s system because of the devastating impact a cyberattack could have.
“I can’t think of anything that would unravel parental trust in a school more than to have their personal details just dumped on the web,” he said. “It is a real risk, and to schools in particular, because of the nature of the information we hold.”
The Australian Signals Directorate’s annual cyberthreat report, published last month, highlighted private schools’ vulnerability to cyberattacks, noting the perception by cybercriminals that private schools had a greater capacity to pay a ransom made them prime targets.
Start the day with a summary of the day’s most important and interesting stories, analysis and insights. Sign up for our Morning Edition newsletter.