The last year and a half have been among the busiest ever for IT and cybersecurity professionals, with ransomware attacks making up a huge portion of high-profile cyberattacks.
The data-encrypting attacks have hit every industry, from manufacturing to infrastructure and retail. However, one critical sector has been hit the hardest: education.
According to Sophos’ “The State of Ransomware in Education” report that surveyed nearly 500 IT decision makers, the education sector is a prime target for ransomware attacks and incurs significant costs beyond paying the ransom when attacked.
Per the report, 44% of education organizations were hit with ransomware in 2020 compared to 37% across all other industries.
Of those schools hit by ransomware, 58% said the attackers succeeded in encrypting their data.
The rapid shift to distance learning may have accelerated an already growing trend, as the survey found nearly three quarters of IT professionals said their cybersecurity workload increased. That isn’t surprising, as enterprise IT pros will likely say the same thing.
The education sector is more likely to pay ransom than many others, the survey found. Over a third of education institutions that had their data encrypted paid ransom to the hackers, good for the third highest level of ransom payment behind just energy and local government.
Read Next: Ransomware Is Now More Than Just Data Encryption
The average ransom paid by the education sector of about $112,400 is much lower than the global average of $170,400, but nearly 90% of organizations that paid a ransom didn’t get all their data back. On average, only 68% of the data was recovered.
Despite the lower-than-average ransom payments, the education sector faces the highest overall costs of recovering from a ransomware attack, Sophos’ report said. In addition to the ransom payment, the average cost of $2.73 million includes downtime, man hours, devices, network and lost opportunity. That’s 48% above the global average.
“This high bill is likely due to many education organizations running outdated and fragmented IT infrastructures supported by understaffed IT teams,” Sophos said in the report. “As a result, in the wake of an attack they are often forced to totally rebuild from the ground up, incurring major financial cost.”
With schools already operating on tight budgets, having to pay $2.73 million could be devastating.
With these facts in mind, IT professionals in education should consider upgrading IT infrastructure, implement a patch management strategy, investing in stronger backup solutions, implementing multi-factor authentication and purchasing cyber insurance to help cut down on the cost of a successful attack.
If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!
Leave a Reply