Ransomware in Education: Declining Attack Rates Mask Rising Costs and Recovery Challenges Sophos’ latest annual report on ransomware in the education sector reveals a complex landscape, where declining attack rates contrast with soaring recovery costs and evolving attacker tactics. The study, based on a survey of 600 IT and cybersecurity leaders in lower and higher education across 14 countries, examines trends from 2023 and highlights critical shifts in the sector’s response to ransomware. Attack Rates Drop, But Risks Remain High While ransomware attacks on educational institutions have decreased 63% of lower education and 66% of higher education organizations were hit in the past year, down from 80% and 79% in 2023 the sector still faces a higher attack rate than the global cross-sector average of 59%. Despite the decline, attackers are increasingly targeting backups, with 95% of affected organizations reporting attempts to compromise them. Of those, 71% saw their backups successfully breached, the second-highest rate across all sectors. Data encryption remains a persistent threat, affecting 85% of lower education and 77% of higher education victims in 2023 slightly higher than the previous year. Lower education’s encryption rate has risen for the second consecutive year, second only to state and local government organizations (98%). Recovery Costs Skyrocket The financial toll of ransomware has surged dramatically. Lower education organizations reported an average recovery cost of $3.76 million in 2024, more than double the $1.59 million in 2023. Higher education saw an even steeper increase, with costs rising nearly fourfold to $4.02 million from $1.06 million the prior year. On average, 52% of computers in lower education and 50% in higher education were impacted per attack, slightly above the cross-sector average of 49%. Ransom Payments and Backup Reliance Climb The propensity to pay ransoms has grown, with 62% of lower education and 67% of higher education organizations opting to pay in 2023 up from previous years. However, backups remain a critical recovery tool, used by 75% of lower education and 78% of higher education victims. Higher education’s reliance on backups has improved significantly, jumping from near the bottom globally in 2023 to second place in 2024, tied with state and local government. A notable shift is the rise in hybrid recovery strategies: 65% of lower education and 69% of higher education victims used multiple methods (e.g., paying the ransom and restoring from backups) in 2023, nearly triple the rates from the previous year. Ransom Demands vs. Payments: A Disparity When organizations paid ransoms, the sums often diverged from initial demands. The median payment for lower education was $6.6 million, while higher education paid $4.4 million. Only 13% of victims paid the exact amount requested. Lower education organizations were more likely to pay less (32%) than the demand, while higher education was the most likely sector globally to pay more (67%). The report underscores the education sector’s growing vulnerability to ransomware, where improved backup strategies coexist with rising costs and increasingly aggressive attacker tactics. The findings are based on a survey conducted by Vanson Bourne between January and February 2024, covering organizations with 100 to 5,000 employees.