"we undertook a range of upgrades to our systems to better protect our data"
Yeah, but that didn't actually work now did it ?
I don't know what it is you upgraded, and to what you upgraded to, but it seems to me that a redesign of your network is in order.
Like, putting a firewall between your network and all that juicy data you are hoarding for no good reason. Maybe add a proxy server and another firewall behind that, to ensure that only the proper computers - which have no Internet access - can access that data.
One more thing : maybe a decade after someone has left your University, you could consider not having that data accessible via the network ? In other words, archive it ?