Compromised Logins Surge as the Most Common Entry Point for Ransomware Attacks

Sophos' 2026 ransomware report finds that identity-based attacks—compromised credentials, phishing, and brute-force logins—now account for the majority of ransomware initial access events (79%), while exploitation of known vulnerabilities has declined; the report details entry-point statistics, recovery behaviors (48% paid ransoms; 66% used backups), median ransom demand ($698,000), and recommends prioritizing identity threat detection and response, MFA enforcement, and credential audits.