As many students across parts of the world return to class, ransomware remains a pressing threat to the education sector. Sophos’ latest annual study, based on the real-world experiences of 441 institutions hit by ransomware in the past year, reveals how lower education (students up to age 18) and higher education providers (over 18) are being impacted.
The report explores how the causes of attacks are evolving, the impact on data and recovery, and sheds new light on the lasting human impact on IT and cybersecurity teams.
Download the report to explore the full findings.
Root causes of attacks – a split picture
In lower education, phishing was the most reported technical root cause, cited in 22% of cases. However, the methods of attack were broadly distributed, with malicious emails, exploited vulnerabilities, and compromised credentials also reported at similar levels. By contrast, higher education providers were more likely to experience attacks through exploited vulnerabilities (35%) — aligning with most industries surveyed.
Organizational factors also varied. Nearly half (49%) of higher education providers identified unknown security gaps as the most common root cause. In lower education, the most frequently cited issues were a lack of expertise and limited capacity to respond to incidents (42% each). Overall, the results suggest higher education faces greater technology challenges, while lower education providers struggle more with staff-related pressures.
Encryption rates fall, defenses show signs of improvement but attackers adapt
Data encryption rates in education have fallen to a four-year low with just 29% of attacks on lower education resulting in encrypted data (the lowest rate recorded in this year’s survey) and 58% in higher education. While encouraging overall, higher education still recorded one of the highest encryption rates across all industries surveyed.
In line with this downward trend, the percentage of attacks stopped before data was encrypted soared — rising from 14% to 67% in lower education and from 21% to 38% in higher education. These record highs suggest that education providers have taken strides to strengthen their defenses.
However, adversaries are adapting: The proportion of education providers hit by extortion-only attacks (where data wasn’t encrypted but a ransom was still demanded) are on the rise, climbing from 1% to 4% for lower education and from 2% to 3% for higher education providers.
Use of backups to recover data falls to four-year low
The use of backups to restore data among education providers has dropped to its lowest point in four years. Among those that had data encrypted, only 59% of lower education institutions and 47% of higher education providers restored data using backups (down from 75% and 78%, respectively). This decline highlights ongoing challenges with maintaining consistent and reliable backup practices across the sector. The rate of education providers paying the ransom to get data back showed a similar trend suggesting a greater reliance on multiple/alternative recovery methods.
Ransom demands and payments plummet
Ransom economics in education shifted dramatically in 2025. Median ransom demands fell sharply, dropping from $3.85M to $1.02M in lower education and from $3.55M to $697K in higher education, placing the latter among the lowest demands recorded across all industries. This suggests that attackers have potentially shifted their focus to alternative targets with larger financial profiles.
Payments followed the same downward trend. In lower education, the median payment fell from $6.60M to just $800K, while higher education saw an even steeper drop from $4.41M to $463K. Both sectors moved from being among the highest payers in 2024 to among the lowest in 2025 suggesting that education institutions are becoming more resilient to ransom pressure.
Recovery costs fall sharply in education, but lower education still bears the highest burden
Average (mean) recovery costs (excluding ransom payments) also declined year over year, dropping from $3.76M to $2.20M in lower education and from $4.02M to just $0.90M in higher education — the joint lowest across all industries surveyed. While this is encouraging, lower education still recorded the highest recovery cost of any sector, likely reflecting the limited IT resources and outdated, fragmented systems typical of the sector.
Ransomware attacks place significant pressure on IT/cybersecurity teams from senior leadership
The survey makes clear that having data encrypted in a ransomware attack has significant repercussions for IT/cybersecurity teams in the education sector, with increased pressure from senior leaders cited as the most common consequence by both lower and higher education providers.
Download the full report for more insights into the human and financial impacts of ransomware on the education sector.
About the survey
The report is based on the findings of an independent, vendor-agnostic survey commissioned by Sophos of 3,400 IT/cybersecurity leaders across 17 countries in the Americas, EMEA, and Asia Pacific, including 441 from the education sector. All respondents represent organizations with between 100 and 5,000 employees. The survey was conducted by research specialist Vanson Bourne between January and March 2025, and participants were asked to respond based on their experiences over the previous year.