Sophos education ransomware survey: review campus email and account protection together
Sophos published its annual education ransomware study, finding that incidents reported by education institutions frequently involved identity-related techniques, including malicious email, phishing, exposed credentials and password guessing. The research highlights that campuses cannot rely on device antivirus alone.
Source Facts
Sophos published an education sector report on 27 August, saying identity-related techniques were involved in 85% of ransomware incidents in its sample. Malicious email was the most frequently cited technical root cause in both school and higher education samples.
The research presents results separately for different education stages and covers overlap between account-related and ransomware incidents. These are respondents' experiences, not evidence that any particular school has been attacked or a test of a product's effectiveness.
Schools can start by reviewing access rights and unusual-activity reporting for teaching staff, administration, students and contractors.
Original sources
Identity-Based Attacks Are Responsible for 85% of Ransomware in Education, Sophos Report Finds
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
Illustration