Identity-based attacks account for 85% of ransomware incidents in education, Sophos finds
Identity-based attack techniques were involved in 85% of ransomware attacks against education institutions, according to Sophos’ State of Ransomware in Education 2026 report. The figure was higher than the 79% cross-sector average.
The techniques covered in the report include malicious email, phishing, compromised credentials and brute-force attacks. Malicious email emerged as the leading technical root cause, accounting for 31% of ransomware attacks in lower education and 29% in higher education.
The report also found that 77% of higher education organisations and 71% of lower education organisations said their ransomware incident was also their most significant identity attack.
Recovery from ransomware was also slower in education than across other sectors. About 26% of education organisations required one to three months to fully recover, compared with 14% across sectors. Lower education institutions recorded the highest proportion of organisations taking a month or more to recover, at 31%.
Average ransomware recovery costs reached...
Copyright of this story solely belongs to expresscomputer.in. To see the full text click HERE
