As more and more schools districts are being targeted by cyberattacks, a bill that requires institutions of higher education to have established cyber security plans passed the New Jersey Assembly Higher Education Committee.

“Colleges and universities can best protect sensitive information and networks by being proactive, not reactive, which our bill requires,” Assemblyman McGuckin (R-Toms River) said in a statement. “Should there be a breach, those institutions must have an updated, detailed plan to recover as quickly and safely as possible.”

McGuckin sponsored the bill along with fellow Assemblyman Paul Kanitra (R-Point Pleasant).

According to the bill, institutions’ plans must address potential security risks and the ways those will be monitored and mitigated. Those plans must be regularly updated to reflect current technologies and information security techniques.

In addition, any cyberattack must be reported within 72 hours to the New Jersey Office of Homeland Security.

The bill comes weeks after a cyberattack aimed at the Freehold Township School District compromised essential network systems and forced the entire district to close for a day and comes amid a crippling cyberattack against Change Healthcare, a company handling orders and patient payments for nearly a third of the country’s population.

Change Healthcare, which is a division of UnitedHealth Group, wrote in an SEC filing that it has “identified a suspected nation-state associated cyber security threat actor” that has “gained access to some of the Change Healthcare information technology systems.”

Organized foreign crime syndicates most often carry out cyberattacks, preying on the vulnerability of understaffed IT departments and dated security systems.

While ransomware attacks are most common, colleges and universities are also vulnerable to data breaches and leaks; phishing attacks; and social media vandalism.

According to Educause.edu, there was a 15% increase of cyberattacks against colleges and universities in the first quarter of 2023 compared with that same timeframe in 2022.

The recovery from a cyberattack can cost more than $1 million, the bill’s sponsor’s said.

“These attacks affect everyone, because ultimately a vulnerable school costs taxpayers money,” Kanitra noted. “We need to ensure sensitive data and wallets are protected.”