Sophos Report: 79% of Ransomware Attacks Start with Compromised Identities

The report finds compromised identities as the leading initial access vector globally, accounting for 79% of ransomware attacks.

Sophos has released its seventh annual State of Ransomware report, based on a vendor-agnostic survey of IT and cybersecurity leaders across 17 countries, including the UAE. The report examines the impact of ransomware on businesses and how prepared organizations are to defend against attacks.

Globally, it found that compromised identities were the leading initial access vector, accounting for 79% of ransomware attacks. In the UAE, organizations affected by ransomware reported an average recovery cost of US$665,000.

According to the report, the prominence of identity attacks in ransomware indicates a shift in method, as attackers increasingly recognize identity as a key component in ransomware delivery. Additionally, for the first time in four years, exploited vulnerabilities are no longer the most common root cause, with malicious email (26%) and phishing (24%) taking the top spot.

However, exploited vulnerabilities remain a high value target: 59% of ransom demands that start with an exploited vulnerability on the firewall are for $1M or more compared to 48% of all attacks.

“As we see ransomware criminals experiment with AI, it has the potential to accelerate their ability to steal valuable assets, hold them hostage and do it at a scale that exceeds their previous capability,” said Ross McKerchar, Chief information security officer, Sophos. “This speed requires careful round-the-clock monitoring of the most exploited means of entry, which our data shows to be stolen and compromised valid accounts. However, the improvement of unguarded open-weight AI models will give attackers a growing advantage in finding and exploiting software vulnerabilities. Defenders cannot rely on patching alone to keep pace, so reducing external exposure and maintaining strong endpoint protection is essential.”

The report also found that, out of the organizations hit by ransomware, 56% had their data encrypted, an increase which has reversed a two-year downward trend.

Ransomware Attacks: Global Highlights

• Two-thirds of ransomware victims (67%) confirmed their ransomware incident was also their most significant identity attack, establishing identity compromise as a primary ransomware delivery mechanism.
• Over half of ransomware attacks (56%) succeeded in encrypting data, including 16% where data was both encrypted and stolen. That success rate is up from 50% in 2025, but below the 75% peak in 2023. In comparison, 38% of ransomware attacks in the UAE resulted in data encryption, including 13% where data was both encrypted and stolen.
• When data is encrypted, attackers have a 50-50 chance of receiving a ransom payment. 48% of organizations whose data was encrypted paid the ransom, bringing the four-year average payment rate to 50%.
• Only 34% of small organizations (100–250 employees) stopped attacks before encryption or extortion. This is significantly behind 3,001–5,000 employee organizations that stopped attacks 46% of the time.
• Multi-factor authentication (MFA) was deployed in some capacity for 97% of incidents where compromised credentials were the root cause of the ransomware attacks, making clear that MFA alone is not enough to stop ransomware, and that coverage gaps create exposure.
• The UK saw the highest median ransom demand recorded for any country at $2.5 million.

Increased investment in backup infrastructure has likely contributed to organizations recovering faster following a ransomware attack; over half (55%) of organizations manage to do so within one week, and 16% in less than a day.

Organizations are continuing to be effective at negotiating with ransomware operators, says Sophos. Among those that chose to pay, 51% successfully negotiated a settlement below the attackers’ initial ransom demand. According to the report, the median ransom demands made by attackers have dropped by 65% over the last two years, and the proportion of organizations paying the ransom to recover data has fallen to 48%, the second-lowest rate on record after 2023 (46%).

While improved strategies have impacted the adversary’s ability to extract financial gain through ransom demands, the average recovery costs following an attack has increased, now at $1.7 million per incident.

“Organizations have strengthened their ransomware resilience in the past year, and those investments are largely paying off,” said McKerchar. “However, ransomware continues to cost organizations millions. As AI becomes more capable, attackers will be able to enumerate identity misconfigurations and weak points across organizations far more cheaply and quickly than before. Organizations can no longer rely on complexity or obscurity to hide gaps in their environment. The same technology also gives defenders an opportunity to find and fix those gaps faster, but only if prevention, detection, and response work together as part of a unified cybersecurity strategy.”

The report recommends that organizations strengthen identity security with phishing-resistant multi-factor authentication and identity threat detection, maintain tested backup and recovery plans, implement regular vulnerability and patch management, and use firewall monitoring and threat detection to identify ransomware attacks at an early stage.

Download the full State of Ransomware 2026 report on Sophos.com.

Disclaimer: This article is based on the Sophos State of Ransomware 2026 report. The survey was conducted by Vanson Bourne on behalf of Sophos during the first quarter of 2026 and included 2,158 IT and cybersecurity decision-makers from organizations across 17 countries that had experienced a ransomware attack in the previous 12 months. Readers are encouraged to review the full report for additional context, methodology, and detailed findings