From Crisis to Stability: Leading My Institution Through a Cybersecurity Attack

By Frederick V. Moore, J.D., President Emeritus, Buena Vista University

In 2010, while I was president, our institution suffered a data breach. Our staff had noticed suspicious activity, and our fears were confirmed when we discovered tampering with our administrative computing system. We promptly hired top-tier legal counsel, a forensic firm to investigate the breach, and a crisis management/public relations firm to handle the significant media attention. Although there was no evidence that personally identifiable information was used for illegal purposes, we established a call center to address the concerns of our constituents and stakeholders and offered free credit monitoring to anyone interested. Fortunately, no lawsuits were filed against the university, though managing the aftermath was demanding for many staff members. After some time, the perpetrator was apprehended, and justice was served. 

Despite excellent advice from the firms we retained, we remained concerned about our vulnerability to such breaches. Our institution had been a leader in learning technology, yet our administrative systems were outdated. We had received high quotes for a new enterprise resource planning (ERP) system but had delayed purchasing, anticipating cost reductions from cloud technology. The breach starkly highlighted the need for an expert assessment of our systems. 

After evaluating several options, we chose CampusWorks to conduct a comprehensive Technology Assessment of our systems, protocols, and policies to ensure our technological infrastructure was secure and up-to-date. We selected CampusWorks after thorough due diligence, impressed by their proven competence, reliability, and trustworthiness.  

The assessment was thorough and revealed that significant updates were necessary, including a recommendation for CampusWorks to lead our IT operations for five years. The review also emphasized the urgent need to acquire a new ERP and modernize our telecommunications system. While these upgrades required significant investment, they were essential for preventing future breaches, improving service to our students, and enhancing our faculty and staff’s work environment, who had struggled with obsolete technology. 

Implementing CampusWorks’ recommendations required skilled change management. We held extensive discussions with our Board of Trustees and the campus community to explain the necessity of these changes. Concerns from our IT staff were particularly poignant; although CampusWorks recommended they remain employed by the institution, their new leader would be an interim chief information officer (CIO) from CampusWorks. Despite initial resistance, this approach ensured a focus on excellence and staff development. CampusWorks also facilitated our ERP acquisition, significantly reducing costs through expert negotiations—ultimately, we paid about a fifth of the previously quoted amounts. 

Despite the inherent challenges of implementing a new ERP, CampusWorks was responsive and proactive. The new systems improved our student recruitment and fundraising efforts, reduced bureaucratic obstacles, and provided faculty with better resources for advising. 

While outsourcing is not a universal solution, it proved to be the right decision in this context, where specialized expertise was crucial. Our confidence in CampusWorks’ integrity and commitment to our best interests was validated throughout our five-year partnership. For any leader considering similar changes, I can confidently recommend trusting in CampusWorks. Their approach not only achieved substantial updates at minimal net expense but also significantly advanced our institutional mission. 

Need help securing your institution’s future?