Surprise! 2016 is on pace to break records in terms of data breach volume—a feat that seems to be accomplished on an annual basis now.

Through August 30, the Identity Theft Resource Center (ITRC) has counted 638 total data breaches with over 28.5 million records exposed. Unfortunately, the seemingly endless cycle of data breaches has made many companies numb to these kinds of security incident statistics.

But we cannot settle, we must prepare, and we need to stay on top of the current state of hacking. Let’s discuss what the future holds regarding cyber attacks.

Key Findings and Trends from the August 2016 ITRC Data Breach Report

You may have seen breaking news regarding high-profile attacks on the U.S. Department of Justice, Snapchat, Verizon, Premier Healthcare and more so far this year, but these stories don’t offer the bigger picture of hacking trends.

Here are the summarized findings from the August 30 edition of the ITRC Data Breach Report, broken down by industry:

• Banking/Financial Services accounted for just 3% of total breaches and didn’t factor into the total count of exposed records.
• The business sector experienced 44% of reported data breaches, but yielded just 9% of exposed records.
• Attacks on education are on the rise (account for 10% of breaches), but exposed records in the industry were accounted for just 1.5% of the total.
• Governmental agencies experienced just 7% of total breaches, but accounted for 43% of exposed records.
• The healthcare industry is still a prime target, experiencing 36% of attacks and yielding 47% of exposed records.

One of the most striking statistics here is that the financial services industry experienced the lowest number of breaches in total and barely yielded any exposed records. Attackers were once relentlessly focused on financial institutions because they were lucrative targets. Now, hackers are moving toward more vulnerable industries like healthcare and education.

We’ve talked a lot about the issues healthcare institutions have had with data breaches and security incidents recently and the ITRC’s findings only solidify concerns for the industry. However, as ransomware attacks in healthcare see greater mainstream attention, it’s only a matter of time before hackers compromise the next soft target.

Companies in the business sector aren’t proving to be such easy targets and governmental agencies have the resources to address current data breach concerns, leaving education as a prime target moving forward.

Ransomware Is Set to Target Education in 2017

The wealth of personally identifiable information (PII) that healthcare companies hold—social security numbers, dates of birth, addresses, financial and health records, etc.—have made it the most vulnerable (and often-targeted) industry for ransomware attacks. That being said, it’s not the only industry that typically lags behind cybersecurity best practices.

Academic institutions often hold the same PII as healthcare companies and tend to focus their cyber efforts on internal experiences rather than external threats. This, combined with the fact that networks at educational institutions support thousands of potentially vulnerable student/faculty endpoints, makes the industry a prime target for cyber attacks moving forward.

2016 has already seen some high profile attacks on the education industry even if the numbers aren’t as dominant in the ITRC report:

• UC Berkeley: A hacker exploited a patching flaw over winter break in 2015 to compromise the records of over 80,000 students, alumni and employees. There was no evidence of stolen information, but the hack symbolizes the weakness of many educational networks.
• University of Central Florida: The impact is unknown, but the institution identified the targets as student-athlete records as well as former student employees at the university. Compromised information could include SSNs, student ID numbers, academic progress data, and more.
• Tidewater Community College: Large universities aren’t the only potential targets for hackers. This small Virginia community college was attacked after an employee in the finance department fell for a phishing scam. PII from over 3,000 current and former employees was affected.

These are just a few data breach examples from the education industry. However, incidents could grow much worse in 2017 as hackers use ransomware to monetize their attacks more effectively. Rather than compromising a network and trying to exfiltrate data over the course of potentially hundreds of days, attackers can encrypt valuable files quickly and collect ransoms.

The point isn’t that other industries can relax their cybersecurity standards—it’s that education will become a more lucrative target for attackers in the coming months and should prepare accordingly.

Whether you’re in a highly-targeted industry like healthcare and government or you’re in an industry such as education where attacks are on the rise, managing the edge of the network is an essential part of network security today.