Identity-based attacks are responsible for 85% of ransomware in education, Sophos report finds

Sophos released its annual State of Ransomware in Education 2026 report , which found that identity-based attack techniques were used in 85% of ransomware attacks against education institutions. Those techniques include malicious email, phishing, compromised credentials , and brute-force attacks. The 85% rate exceeded the cross-sector average of 79%, underscoring the role that identity compromise continues to play in ransomware incidents targeting institutions in both higher and lower education.