Identity-Based Attacks Are Responsible for 85% of Ransomware in Education, Sophos Report Finds
OXFORD, U.K., Aug. 27, 2026 (GLOBE NEWSWIRE) -- Sophos, a global cybersecurity leader, today released its annual State of Ransomware in Education 2026 report, which found that identity-based attack techniques were used in 85% of ransomware attacks against education institutions. Those techniques include malicious email, phishing, compromised credentials and brute force attacks. The 85% rate exceeded the cross-sector average of 79%, underscoring the role identity compromise continues to play in ransomware incidents targeting lower and higher education institutions.
Malicious email was the leading technical root cause of ransomware attacks in both lower education (31%) and higher education (29%). The report also found that 77% of higher education organizations and 71% of lower education organizations said their ransomware incident was also their most significant identity attack.
Education institutions also recover more slowly from attacks. Lower and higher education institutions are roughly twice as likely as the cross-sector average to need one to three months to fully recover. Lower education fared worst of all: 31% took a month or more to get back on their feet, the highest share of any sector.
"Education institutions remain attractive targets because they hold vast amounts of personal data while operating under significant resource constraints," said Ross McKerchar, chief information security officer, Sophos. "Today's attackers don't need a crowbar when they can steal the keys. Identity compromise has become one of the most effective paths into an organization, and AI is only increasing the speed, scale and sophistication of these attacks. The most resilient institutions are the ones that treat identity as a core security control and combine it with integrated detection and response capabilities that can stop threats before they become full-scale incidents.”
Additional findings from the report include:
The findings are based on an independent survey of 226 IT and cybersecurity leaders in the education sector across 17 countries whose organizations were impacted by ransomware in the past year. Research was conducted between January and March 2026. For the purposes of this report, age cohorts are defined as lower education (typically students up to age 18) and higher education (typically students over 18). This is the sixth year Sophos has tracked this data.
To download the full State of Ransomware in Education 2026 report, visit https://www.sophos.com/en-us/resources/white-papers/state-of-ransomware-in-education
About Sophos
Sophos, a global cybersecurity leader, defends more than 625,000 organizations worldwide with Sophos Fusion, the industry's first and most complete AI-native cybersecurity defense system: a single, connected architecture where every control point operates as one. Powered by agentic AI and elite human expertise, Sophos detects, investigates, and neutralizes threats before they become business-disrupting events. Working alongside a global ecosystem of managed service providers, resellers, and technology partners, Sophos compounds intelligence from every threat encountered and every environment defended to make every customer's defense stronger than the last. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.