Ransomware Hit 56% of K-12 Organizations Worldwide in 2021, Sophos Survey Finds

Schools Also Most Likely To Pay a Ransom, Cybersecurity Firm Says

Cybersecurity firm Sophos today released its annual State of Ransomware report showing ransomware attacks nearly doubled in 2021 from the year before, according to results of a survey of 5,600 IT professionals across many sectors.

Across all sectors surveyed, 66% of respondents said their organizations were hit with ransomware in 2021, up from 37% in 2020. Among K–12 schools included in the survey, 56% of K–12 IT professionals responding, representing 320 districts, said they were a victim of ransomware last year.

K–12 schools were the most likely of the sectors surveyed to pay a ransom, as well, the Sophos survey found. The average ransom payout across all sectors occurred in attacks where the threat actors encrypted the victims’ data; that average ransom amount increased nearly fivefold to $812,360 from 2020, with a 300% increase in the proportion of organizations paying ransoms of $1 million or more, Sophos said.

Key Findings among K–12 Respondents:

  • 56% of K–12 districts, or 320, were hit by ransomware last year.
  • 76% of K–12 districts hit by ransomware last year used backups to recover.
  • 45% of K–12 districts paid the ransom.
    • Among K–12 districts that paid up, they reported an average of 60% of their data being restored.
  • 99% of K–12 districts hit by ransomware said district cyberinsurance covered at least some of the associated costs.
    • 58% of K–12 ransomware victims said cyberinsurance paid clean-up costs.
    • 53% of K–12 ransomware victims said cyberinsurance paid the ransom.
    • 27% of K–12 ransomware victims said cyberinsurance paid other associated recovery costs.

The survey, conducted by research agency Vanson Bourne, was conducted during January and February 2022, according to Sophos.

“As ransomware has become more prevalent, organizations have got better at getting at dealing with the aftermath of an attack,” Sophos’ report said. “Almost all organizations hit by ransomware in the last year (99%) now get some encrypted data back, up slightly from 96% last year.”

Key Findings about Restoring Data

  • The No. 1 method used to restore data is backups, used by 73% of respondents whose data was encrypted.
  • 46% reported that they paid the ransom to restore data.
  • Almost half (44%) of the respondents whose organization’s data had been encrypted used multiple methods to restore data.
  • Organizations that paid got back only 61% of their data on average.
  • Only 4% of those that paid the ransom got ALL their data back in 2021, down from 8% in 2020.

A Warning for Relying on Backups & CyberInsurance

Of the respondents who said they weren’t hit by ransomware in 2021 and they don’t expect to be hit in the future, 72% are relying on measures that will not prevent a ransomware attack, Sophos noted: 57% of these respondents cited backups and 37% cited cyberinsurance, with some selecting both options. “While these elements help you recover from an attack, they don’t prevent it in the first place,” the report said.

Almost all the respondents, or 94%, said the process for securing cyberinsurance had become more laborious over the last year.

“As the cyber insurance market hardens and it becomes more challenging to secure cover, 97% of organizations that have cyber insurance have made changes to their cyber defense to improve their cyber insurance position,” the report said.

ConvergeOne, a nationwide provider of cybersecurity services and digital infrastructure, told THE Journal in January that school districts renewing or shopping for cyberinsurance this year can expect potential insurers to conduct an in-depth analysis of the district’s network security before a policy can be purchased.

Senior Director of Cybersecurity Chris Ripkey said K–12 schools without mature security systems in place will no longer be able to use their cyberinsurance policies as a “get of jail free card” when cyberattacks occur.

School districts shopping for or renewing their cyberinsurance, he said, can expect to be asked to demonstrate that they have the following protections, at a minimum, in place:

  • Multi-factor authentication
  • Antivirus and malware protection
  • A mature data privacy program to protect student and staff information
  • A robust patch management system
  • A managed endpoint detection and response services
  • Immutable backups separate from the rest of the infrastructure

“The cyberinsurance brokers will ask for all this information in a self-assessment, and if you don’t meet the minimum requirements, they are not going to insure your district, or your premiums are going to be a lot higher,” Ripkey emphasized. “Our advice is to do your own full assessment before shopping for insurance — take stock of your security practices and where you stand.”

Read the full cyberinsurance report to learn more about changes in the K–12 cyberinsurance landscape.

The State of Ransomware survey results can be downloaded at the Sophos website.

About the Author

Kristal Kuykendall is editor, 1105 Media Education Group. She can be reached at [email protected].


Featured

  • ClassVR headsets

    Avantis Education Launches New Headsets for ClassVR Solution

    Avantis Education recently introduced two new headsets for its flagship educational VR/AR solution, ClassVR. According to a news release, the Xcelerate and Xplorer headsets expand the company’s offerings into higher education while continuing to meet the evolving needs of K–12 users.

  • three silhouetted education technology leaders with thought bubbles containing AI-related icons

    Ed Tech Leaders Rank Generative AI as Top Tech Priority

    In a recent CoSN survey, an overwhelming majority of ed tech leaders (94%) said they see AI as having a positive impact on education. Respondents ranked generative AI as their top tech priority, with 80% reporting their districts have gen AI initiatives underway, or plan to in the current school year.

  • magnifying glass highlighting the letters “AI” within lines of text

    New Turnitin Bypasser Detection Feature Helps Identify Use of AI Humanizer Tools

    Turnitin has expanded its AI writing detection capabilities with AI bypasser detection, a feature designed to help identify text that has been modified by AI humanizer tools.

  • laptop displaying a glowing digital brain and data charts sits on a metal shelf in a well-lit server room with organized network cables and active servers

    Cisco Unveils AI-First Approach to IT Operations

    At its recent Cisco Live 2025 event, Cisco introduced AgenticOps, a transformative approach to IT operations that integrates advanced AI capabilities to enhance efficiency and collaboration across network, security, and application domains.