Sophos: Identity attacks used in 85% of education ransomware incidents

Identity-based attack techniques were involved in 85% of ransomware attacks against education institutions, according to Sophos’ State of Ransomware in Education 2026 report. The findings show that identity compromise—including malicious email, phishing, compromised credentials and brute-force attacks—plays a major role in ransomware incidents targeting both lower and higher education. The rate was higher than the […]