The global education sector is showing significant resilience against ransomware, according to Sophos’ fifth annual State of Ransomware in Education report. The study, which surveyed 441 IT and cybersecurity leaders worldwide, found that schools and universities are making steady progress in defending against cyberattacks—with fewer ransom payments, faster recovery times, and sharply reduced costs.
Ransomware has long been one of the most persistent threats to education. Primary and secondary schools, often underfunded and understaffed, remain particularly vulnerable. The impact of an attack goes far beyond technical disruption: classes are interrupted, budgets strained, and sensitive data on students and staff put at risk. Without strong defenses, schools face not only resource losses but also potential erosion of public trust.
Key signs of progress
The 2025 Sophos study indicates that institutions are becoming better equipped to respond, forcing cybercriminals to adjust tactics. While many attackers now attempt extortion without encrypting data, the share of victims paying ransoms has dropped significantly. At the same time, 97% of institutions hit with encryption attacks were able to recover data. Among the key findings:
- Better at blocking attacks: Lower education institutions reported stopping 67% of attempted ransomware incidents before data encryption, while higher education blocked 38%—the strongest results in four years.
- Falling ransom costs: Ransom demands fell by 73% in 2024, with average payments plunging from US$6M to US$800K in lower education, and from US$4M to US$463K in higher education.
- Lower recovery costs: Excluding ransom, recovery costs dropped 77% for higher education and 39% for lower education, though the latter still reported the highest recovery expenses across all industries surveyed.
Gaps and ongoing risks
Despite this progress, vulnerabilities remain. The survey found that:
- 64% of victims lacked adequate protection solutions.
- 66% struggled with staffing shortages or skills gaps.
- 67% admitted to critical security blind spots.
Emerging AI-powered threats are amplifying these risks. Nearly one in four ransomware attacks in lower education originated from phishing, a tactic now enhanced by AI-driven deepfakes and convincing social engineering. In higher education, adversaries targeted valuable assets such as AI research datasets, exploiting unpatched vulnerabilities (35%) and previously unknown security flaws (45%).
The human toll is also significant: every institution with encrypted data reported strain on IT staff. Over 25% of affected personnel took leave after an attack, while nearly 40% reported heightened stress and more than one-third expressed guilt for not preventing breaches.
“Ransomware attacks in education don’t just disrupt classrooms—they disrupt entire communities,” said Alexandra Rose, Director of CTU Threat Research at Sophos. “While schools are getting better at responding, prevention must remain the top priority. That means planning, investment, and collaboration, especially as attackers increasingly deploy AI.”
Next steps for stronger defenses
Drawing from its work with thousands of educational institutions, Sophos recommends:
- Prioritize prevention: Build on lower education’s success in stopping ransomware pre-encryption.
- Unify strategies: Coordinate defenses across complex IT systems to eliminate visibility gaps.
- Reduce staff burden: Ease pressure on IT teams through managed detection and response (MDR) and 24/7 monitoring.
- Strengthen response readiness: Develop robust incident response plans, conduct drills, and ensure round-the-clock coverage.
The State of Ransomware in Education 2025 report is based on a vendor-agnostic survey conducted between January and March 2025 across 17 countries, involving institutions with 100 to 5,000 employees.
