Identity-based attack techniques were responsible for 85 per cent of ransomware attacks against education institutions over the past year, above the 79 per cent cross-sector average, a new report by Sophos has found.

The State of Ransomware in Education 2026 report showed that techniques including malicious email, phishing, compromised credentials and brute-force attacks were the dominant path into education institutions. Malicious email was the leading technical root cause of ransomware attacks in both lower education (31 per cent) and higher education (29 per cent), and 77 per cent of higher education organisations and 71 per cent of lower education organisations said their ransomware incident was also their most significant identity attack.

Slower recovery, rising costs for education institutions

Education institutions took longer to bounce back than organisations in other sectors. Lower and higher education institutions were roughly twice as likely as the cross-sector average to need one to three months to fully recover, with lower education faring worst: 31 per cent took a month or more to get back on their feet, the highest share of any sector surveyed.

Average recovery costs across the sector reached US$2.26 million, above the US$1.7 million cross-sector average. Data encryption rates in lower education more than doubled year-on-year, rising from 29 per cent in 2025 to 61 per cent in 2026, while the median ransom demand for education institutions stood at US$775,200, higher than the cross-sector median of US$698,000.

Human cost weighs on stretched security teams

The report pointed to a mounting toll on IT and security teams. Around 39 per cent of education organisations reported staff absences due to stress or mental health issues following a ransomware attack, compared with 29 per cent across all sectors. Leadership turnover was also higher, with 29 per cent of higher education and 27 per cent of lower education teams seeing leadership replaced after an attack, against a cross-sector average of 21 per cent.

• 85% of education ransomware attacks involved identity-based techniques, versus 79% cross-sector
• Recovery costs averaged US$2.26 million, against a US$1.7 million cross-sector average
• Data encryption rates in lower education rose from 29% to 61% year-on-year
• 39% of education organisations reported staff absences linked to stress after an attack

“Today’s attackers don’t need a crowbar when they can steal the keys. Identity compromise has become one of the most effective paths into an organisation,” said Ross McKerchar, Chief Information Security Officer, Sophos.

The findings are based on an independent survey of 226 IT and cybersecurity leaders in the education sector across 17 countries whose organisations were affected by ransomware in the past year, conducted between January and March 2026. This is the sixth year Sophos has tracked the data.