Hackers have given Harvard, Stanford, the National University of Singapore (NUS) and nearly 9,000 other schools until May 12 to negotiate or face the public release of stolen student data, in what cybersecurity firms are calling the largest education-sector cyberattack on record.