Education Sector Reports the Highest Rate of Ransomware Attacks: Sophos Survey
                     Education Sector Reports the Highest Rate of 
Ransomware Attacks: Sophos Survey
Education Sector Reports the Highest Rate of Ransomware Attacks: Sophos has released a new 
sectoral survey report, “The State of Ransomware in Education 2023,” which found that education 
reported the highest rate of ransomware attacks in 2022. Over the past year, 79% of higher 
educational organizations surveyed reported stuff hit by ransomware, while 80% of lower 
educational organization's surveyed were targeted—an increase from 64% and 56% in 2021, 
respectively. Additionally, the sector reported one of the highest rates of ransom payment with 
increasingly than half (56%) of higher educational organization's paying and nearly half (47%) of 
lower educational organization's paying the ransom. However, paying the ransom significantly 
increased recovery financing for both higher and lower educational organizations. Recovery 
financing (excluding any ransoms paid) for higher educational organizations that paid the ransom 
were $1.31 million when paying the ransom versus $980,000 when using backups. For lower 
educational organizations', the stereotype recovery financing were $2.18 million when paying the 
ransom versus $1.37 million when not paying. Paying the ransom moreover lengthened recovery 
times for victims. For higher educational organizations', 79% of those that used backups recovered 
within a month, while only 63% of those that paid the ransom recovered within the same 
timeframe. For lower educational organizations', 63% of those that used backups recovered within a 
month versus just 59% of those that paid the ransom. “While most schools are not cash-rich, they 
are very highly visible targets with firsthand widespread impact in their communities. The pressure 
to alimony the doors unshut and respond to calls from parents to ‘do something’ likely leads to 
pressure to solve the problem as quickly as possible without regard for cost. Unfortunately, the data 
doesn’t support that paying ransoms resolves these attacks increasingly quickly, but it is likely a 
factor in victim selection for the criminals,” said Chester Wisniewski, field CTO, Sophos. For the 
education sector, the root causes of ransomware attacks were similar to those wideness all sectors, 
but there was a significantly greater number of ransomware attacks involving compromised 
credentials for both higher and lower educational organisations (37% and 36% respectively versus 
29% for the cross-sector average). 
Additional key findings from the report include:
-Exploits and compromised credentials rumored for increasingly than three-
fourths (77%) of ransomware attacks versus higher educational organisations; 
these root causes rumored for increasingly than two-thirds (65%) of attacks 
versus lower educational organisations -The rate of encryption stayed well-
nigh the same for higher educational organisations (74% in 2021 versus 73% 
in 2022), but increased from 72% to 81% wideness lower educational 
organisations during the past year. -Higher educational organisations reported 
a lower rate of using backups than the cross-sector stereotype (63% versus 
70%). This is the third lowest rate of replacement use wideness all sectors. 
Lower educational organisations, on the other hand, had a slightly higher rate 
of using backups than the global stereotype (73%). “Abuse of stolen 
credentials is worldwide wideness sectors for ransomware criminals, but the 
lack of adoption of multifactor hallmark (MFA) technology in the education 
sector makes them plane increasingly at risk of this method of compromise. 
Like the U.S. federal government’s initiative to mandate all agencies use MFA, 
it is time for schools of all sizes to employ MFA for faculty, staff, and students. 
It sets a good example and is a simple way to stave many of these attacks 
from getting in the door,” said Wisniewski.