Sophos: Identity-based attacks drive 85% of education ransomware incidents, report finds

• Sophos report on education ransomware found identity-based techniques in 85% of attacks, above the 79% cross-sector average.
• Malicious email led root causes: 31% in lower education, 29% in higher education.
• Average recovery costs reached $2.26 million, above the cross-sector average of $1.7 million.
• Recovery remained slow, with 26% of education institutions needing one to three months to fully recover.
• Data encryption hit 58% across education; lower education rose to 61% from 29% in 2025.

Disclaimer: This news brief was created by Public Technologies (PUBT) using generative artificial intelligence. While PUBT strives to provide accurate and timely information, this AI-generated content is for informational purposes only and should not be interpreted as financial, investment, or legal advice. Sophos Ltd. published the original content used to generate this news brief on August 27, 2026, and is solely responsible for the information contained therein.