Information Security

Education Impacted by Ransomware More Than Any Other Sector

• By David Nagel
• 05/18/23

In its new State of Ransomware 2023 report, data security provider Sophos found that the education sector had been impacted by ransomware significantly more than any other sector.

The report was based on survey data from more than 3,000 IT and data security professionals across sectors. Overall, last year, 66% of organizations reported that they had been the victims of a ransomware attack. In PreK–12, that figure was 80%. Higher education followed closely behind, at 79%.

The report also found that:

• Data was successfully encrypted by attackers in 76% of cases, the highest success rate in four years;

• Data was also stolen in 30% of cases where it was successfully encrypted ("double-dipping");

• Vulnerability exploits were the most common vector, accounting for 36% of attacks;

• Compromised credentials were the second-most common vector for ransomware, at 29%;

• Across all sectors, the rate of ransomware attacks (66%) did not change year over year.

"Sophos' latest report is a clarion reminder that ransomware remains a major threat, both in scope and scale," said Megan Stifel, executive director of the Ransomware Task Force and chief strategy officer, Institute for Security and Technology, in a statement released to coincide with the report. "This is particularly true for ‘target-rich, resource-poor’ organizations that don’t necessarily have their own in-house resources for ransomware prevention, response and recovery."

The report noted that the average cost of data recovery for organizations that did not pay the demanded ransom was $375,000. The cost for organizations that paid the ransom was double that amount, $750,000.

"Incident costs rise significantly when ransoms are paid," said Chester Wisniewski, field CTO, Sophos, in a prepared statement. "Most victims will not be able to recover all their files by simply buying the encryption keys; they must rebuild and recover from backups as well. Paying ransoms not only enriches criminals, but it also slows incident response and adds cost to an already devastatingly expensive situation."

The complete report, with breakdowns by sector, can be accessed here.