Pennsylvania State University has agreed to pay the Justice Department $1.25 million to settle claims of misrepresenting its cybersecurity compliance to the federal government and leaving sensitive data improperly secured.

"Penn State did not implement certain NIST SP 800-171 security requirements, and did not adequately document, develop and implement plans of action designed to correct deficiencies," the DoJ alleged.