Published: 10:51 AM, 05 September 2026
Identity-based attacks are responsible for 85% of ransomware in education
Sophos, a global cybersecurity leader, recently released its annual State of Ransomware in Education 2026 Sophos State of Ransomware in Education report, which found that identity-based attack techniques were used in 85% of ransomware attacks against education institutions.
Those techniques include malicious email, phishing, compromised credentials and brute force attacks. The 85% rate exceeded the cross-sector average of 79%, underscoring the role identity compromise continues to play in ransomware incidents targeting lower and higher education institutions.
Malicious email was the leading technical root cause of ransomware attacks in both lower education (31%) and higher education (29%). The report also found that 77% of higher education organizations and 71% of lower education organizations said their ransomware incident was also their most significant identity attack.
Education institutions also recover more slowly from attacks. Lower and higher education institutions are roughly twice as likely as the cross-sector average to need one to three months to fully recover. Lower education fared worst of all: 31% took a month or more to get back on their feet, the highest share of any sector.
Sophos CISO Ross McKerchar said, "educational institutions are prime targets because they hold large amounts of personal data but have limited resources. He warned that identity theft and AI are making cyberattacks faster and more sophisticated, urging institutions to strengthen identity security and threat detection."
Additional findings from the report include:
Education organizations reported greater operational challenges than the cross-sector average. 53% of higher education institutions cited a lack of skills or expertise, compared with 35% across sectors. Lower education most commonly cited human error (52%), lack of protection (47%), security gaps (42%) and limited capacity (41%).
Data encryption rates more than doubled in lower education.Encryption rose from 29% in 2025 to 61% in 2026, while 58% of education ransomware attacks resulted in encrypted data.
Data restoration relied heavily on backups. 77% of lower and 69% of higher education institutions restored encrypted data using backups, above the 66% cross-sector average.
Ransom demands remained elevated despite a multi-year decline. The median ransom demand was $775,200, above the $698,000 cross-sector median, while ransom payments increased by $15,000 from 2025.
Recovery costs increased and recovery times remained lengthy. Average recovery costs reached $2.26 million, compared with $1.7 million across sectors. 26% of education institutions took one to three months to fully recover.
The human toll on IT and security teams intensified. 53% of higher education teams reported increased leadership pressure, while 39% reported staff absences due to stress or mental health issues. Leadership replacement was reported by 29% of higher and 27% of lower education teams.
The findings are based on an independent survey of 226 IT and cybersecurity leaders across 17 countries, conducted between January and March 2026. This is the sixth year Sophos has tracked ransomware trends in education.
