Report: Educational Institutions Pay Huge Ransom to Hackers

Emma Okonji

Sophos, a global leader of innovative security solutions that defeat cyberattacks, has released its findings from its annual sector survey report, tagged: “The State of Ransomware in Education 2024,” which showed that most educational institutions in the world that were attacked with ransomware, paid more than the original ransom demanded by hackers.

 According to the report, the median ransom payment is $6.6 million for lower education and $4.4 million for higher education organisations. 

In addition, the survey stated that 55 per cent of lower education respondents and 67 per cent of higher education respondents paid more than the initial demand. 

Ransomware attacks are causing more of a strain as only 30 per cent of ransomware victims surveyed in both lower and higher education were able to fully recover in a week or less, down from last year’s 33 per cent (lower education) and 40 per cent (higher education).

The report suggested that the slow recovery rate could likely be due to education organisations operating with limited teams and resources, making it harder for them to coordinate recovery efforts. 

Analysing the report, Director, Field CTO at Sophos, Chester Wisniewski, said: “Unfortunately, schools, universities and other educational institutions are targets that are beholden to municipalities, communities and the students themselves, which inherently creates high pressure situations if they are hit and destabilised by ransomware. Educational institutions feel a sense of responsibility to remain open and continue providing their services to their communities. These two factors could be contributing to why victims feel so much pressure to pay.

“We also know that ransomware attackers have upped the ante when it comes to getting paid. Compromising their victims’ backups is now a mainstream element of ransomware attacks, giving adversaries the opportunity to subsequently increase the ransom demand when it is clear that the data cannot be recovered without the decryption key.” 

Despite difficult dealings with ransomware, the overall attack rate dropped over the last year. Sixty-three percent of lower education organizations and 66 per cent of higher education organisations were hit by ransomware attacks – down from 80 per cent and 79 per cent, respectively. At the same time, the rate of data encryption has increased slightly, with 85 per cent of attacks on lower education and 77 per cent of attacks on higher education organisations resulting in data encryption, slightly up from the 81 per cent and 73 per cent, respectively, reported in the 2023 survey.

The survey reveals that exploited vulnerabilities were the leading root cause of attacks in education, providing cybercriminals with a way into the network for 44 per cent of lower education and 42 per cent of higher education ransomware attacks.