My advice;
Talk to a lawyer and have them draw up the proper paperwork to go after the creator of this malicious "Bitcoin".
This is not how civil liability would work in this case.
The university would be liable in the event that the students' personal data was actually accessed and used.
