this is illegal anyways––should they still care about my report?
Very much so.
To give one of a by now long series of such examples, consider (one of) the Yahoo hack, for example the 1 billion account hack reported in late 2016 (see also Krebs's coverage).
To quickly cover why "this is illegal anyway" is not a legitimate response:
- Yahoo had some sensitive data (in this case, user emails, passwords, and possibly more) stolen, yet Yahoo still has a duty to announce (and investigate) the hack
- that duty extends to its financial reporting, as explained in the footer of one of their press releases about the impact to users:
More information about potential risks and uncertainties of security breaches that could affect the Company’s business and financial results is included under the caption “Risk Factors” in the Company’s Quarterly Report on Form 10-Q for the quarter ended September 30, 2016, which is on file with the SEC and available on the SEC’s website at www.sec.gov.
- depending on your country, the duty of reporting may also be tied to fines and other legal or financial consequences (Europe, for example).
All this tends to focus on Personally Identifiable Information (PII), but in the case of a university, the loss or theft of research (particularly when not protected by patents) could impact the financial status of the university.
Not to mention the fact that universities do also hold PII, and so a breach would need to be investigated to determine what kind of data may have leaked.
I am not a lawyer, but there are so many cases where, at the very least, investigation would be warranted (if not required to determine the legal consequences), that I think the report would (assuming it was felt to be reliable, and accurate) given attention.
If you provide bad (or even overly noisy) reporting, then it may be they will ignore your report. But I would be surprised if conclusive evidence of a breach would be ignored.