Welcome to the sixth edition of the annual Sophos State of Ransomware in Education report, which reveals the reality of ransomware for both lower education including K-12, primary, and secondary schools — typically for students under 18 years old) and higher education (universities, colleges, and equivalent establishments — typically for students over 18 years old) providers in 2026.
This year’s report also shines new light on previously unexplored areas, including where attacks start in the environment, the defensive role of multi-factor authentication (MFA) and firewalls, and the connection between identity attacks and ransomware.
Drawing on the real-world experiences of 226 education IT and cybersecurity leaders, 131 from lower education and 95 from higher education institutions hit by ransomware in the past year.
