Sophos has released its fifth annual State of Ransomware in Education report, revealing a sharp decline in ransom payments and recovery costs across the sector.
The global survey, which included 441 IT and cybersecurity leaders, shows that schools are making progress in combating ransomware, achieving faster recovery rates and blocking more attacks before files are encrypted.
According to the report, ransom demands fell by 73 per cent over the past year, while average payments dropped from $6 million to $800,000 in lower education, and from $4 million to $463,000 in higher education.
Recovery costs outside ransom payments also decreased, falling 77 per cent in higher education and 39 per cent in lower education.
Sophos noted that 97 per cent of victims who experienced data encryption were able to recover their files, while more schools are preventing attacks altogether, 67 per cent in primary and secondary education, and 38 per cent in higher education, the highest rates in four years.
Despite these gains, the study highlighted significant challenges. Sixty-four per cent of victims reported ineffective protection solutions, 66 per cent cited a lack of personnel or expertise, and 67 per cent admitted to security gaps. Stress and burnout remain widespread among IT teams, with nearly 40 per cent reporting anxiety following attacks.
The report also warned that cybercriminals are shifting tactics, increasingly attempting to extort money without encrypting data and leveraging emerging AI-powered threats.
Alexandra Rose, Director of CTU Threat Research at Sophos, said prevention remains the most critical priority. “It is encouraging to see schools getting better at responding and recovering, but the real opportunity is to stop attacks before they start,” she said.
