Education Impacted by Ransomware More Than Any Other Sector

In its new State of Ransomware 2023 report, data security provider Sophos found that the education sector had been impacted by ransomware significantly more than any other sector.

The report was based on survey data from more than 3,000 IT and data security professionals across sectors. Overall, last year, 66% of organizations reported that they had been the victims of a ransomware attack. In PreK–12, that figure was 80%. Higher education followed closely behind, at 79%.

The report also found that:

  • Data was successfully encrypted by attackers in 76% of cases, the highest success rate in four years;

  • Data was also stolen in 30% of cases where it was successfully encrypted ("double-dipping");

  • Vulnerability exploits were the most common vector, accounting for 36% of attacks;

  • Compromised credentials were the second-most common vector for ransomware, at 29%;

  • Across all sectors, the rate of ransomware attacks (66%) did not change year over year.

"Sophos' latest report is a clarion reminder that ransomware remains a major threat, both in scope and scale," said Megan Stifel, executive director of the Ransomware Task Force and chief strategy officer, Institute for Security and Technology, in a statement released to coincide with the report. "This is particularly true for ‘target-rich, resource-poor’ organizations that don’t necessarily have their own in-house resources for ransomware prevention, response and recovery."

The report noted that the average cost of data recovery for organizations that did not pay the demanded ransom was $375,000. The cost for organizations that paid the ransom was double that amount, $750,000.

"Incident costs rise significantly when ransoms are paid," said Chester Wisniewski, field CTO, Sophos, in a prepared statement. "Most victims will not be able to recover all their files by simply buying the encryption keys; they must rebuild and recover from backups as well. Paying ransoms not only enriches criminals, but it also slows incident response and adds cost to an already devastatingly expensive situation."

The complete report, with breakdowns by sector, can be accessed here.

About the Author

David Nagel is the former editorial director of 1105 Media's Education Group and editor-in-chief of THE Journal, STEAM Universe, and Spaces4Learning. A 30-year publishing veteran, Nagel has led or contributed to dozens of technology, art, marketing, media, and business publications.

He can be reached at [email protected]. You can also connect with him on LinkedIn at https://www.linkedin.com/in/davidrnagel/ .


Featured

  • blue AI cloud connected to circuit lines, a server stack, and a shield with a padlock icon

    Report: AI Security Controls Lag Behind Adoption of AI Cloud Services

    According to a recent report from cybersecurity firm Wiz, nearly nine out of 10 organizations are already using AI services in the cloud — but fewer than one in seven have implemented AI-specific security controls.

  • stacks of glowing digital documents with circuit patterns and data streams

    Mistral AI Intros Advanced AI-Powered OCR

    French AI startup Mistral AI has announced Mistral OCR, an advanced optical character recognition (OCR) API designed to convert printed and scanned documents into digital files with "unprecedented accuracy."

  • robot waving

    Copilot Updates Aim to Personalize AI

    Microsoft has introduced a range of updates to its Copilot platform, marking a new phase in its effort to deliver what it calls a "true AI companion" that adapts to individual users' needs, preferences and routines.

  • teenager interacts with a chatbot on a computer screen

    Character.AI Rolls Out New Parental Insights Feature Amid Safety Concerns

    Chatbot platform Character.AI has introduced a new Parental Insights feature aimed at giving parents a window into their children's activity on the platform. The feature allows users under 18 to share a weekly report of their chatbot interactions directly with a parent's e-mail address.