Compromised credentials accounted for 23% of ransomware incidents.

Publisher	Sophos
Report	The State of Ransomware 2026
Published	15 July 2026
Topics	Identity, Ransomware, Compromised Credentials

Published by Sophos in The State of Ransomware 2026, 15 July 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

67% of ransomware victims confirmed their ransomware incident was the same event as their most significant identity attack.

Sophos, 18/07/2026

67% of root causes across 661 incident response and managed detection and response (MDR) cases are identity-related.

Sophos, 18/07/2026

79% of ransomware attacks start with an identity-based approach.

Sophos, 18/07/2026

Multi-factor authentication (MFA) is missing where it matters in 59% of IR and MDR cases.

Sophos, 18/07/2026

97% of victims where compromised credentials are identified as the root cause have MFA enabled in some form at the time of the attack.

Sophos, 18/07/2026

100% of executives have breach data linking their name to at least one current email address.

Nisos, 18/07/2026

Get the newsletter

Weekly cybersecurity statistics by email.