Identity-based attack techniques were involved in 85% of ransomware attacks against education institutions, according to Sophos’ State of Ransomware in Education 2026 report. The figure was higher than the 79% cross-sector average.