Universities struggle to keep personal data safe from theft