Fake Emails Now Beat Software Flaws as the Number-One Way Ransomware Gets In
A Sophos survey of more than 2,000 organisations hit by ransomware finds that phishing and malicious emails now cause half of all attacks, while stolen passwords are defeating even multi-factor authentication at an alarming rate.
Key points
- Sophos surveyed 2,158 IT and security leaders across 17 countries in organisations hit by ransomware in the past year, publishing results in its State of Ransomware 2026 report.
- Malicious email (26%) and phishing, where criminals send fake emails to trick staff into handing over passwords (24%), together caused half of all ransomware attacks surveyed.
- Exploiting software flaws fell from the top cause three years running to third place, dropping from 32% to 18% of attacks.
- Stolen login credentials caused 23% of attacks, and 97% of those victims already had multi-factor authentication switched on.
- 67% of ransomware victims said the attack was also the most serious identity-related incident they suffered that year.
For three years running, criminals broke into company networks by finding and exploiting unpatched software flaws. That era appears to be over.
Sophos published its State of Ransomware 2026 report this week. The findings, first reported by Dark Reading, come from 2,158 IT and security leaders in organisations that suffered a ransomware attack over the past year, across 17 countries.
Phishing and malicious emails now account for half of all ransomware entry points. Software vulnerabilities, long the dominant route in, fell sharply from 32% to 18%. We first covered Sophos on 8 July 2026 in "When your AI coder looks exactly like a hacker to the security software"; the company's research keeps landing on the same uncomfortable truth: defenders are losing ground at the human layer, not the technical one.
Why are stolen passwords beating multi-factor authentication?
Stolen credentials caused 23% of attacks, making them the third most common entry point. What makes that figure striking is that 97% of those victims already had multi-factor authentication (MFA), the extra step that asks users to confirm their identity a second way after entering a password, switched on.
Sophos offers two explanations. MFA may not have been deployed across every system, leaving gaps. Criminals are also developing ways to bypass certain types, particularly push-based methods where a user simply taps "approve" on their phone.
The most attack-resistant form, FIDO2 hardware tokens, physical keys that generate a code no fake website can copy, ranked only fourth in how commonly victims had deployed it.
"Every layer of defense, even if it can be bypassed, is a speed bump, an alert, a potential clue to trigger a threat hunt," Chet Wisniewski, director and global field CISO at Sophos, told Dark Reading.
Sophos recommends deploying MFA everywhere without exception, running regular checks on which accounts have access to what, and investing in identity threat detection, a discipline focused on spotting when a legitimate account is being used suspiciously rather than waiting to catch malware.
Should you worry?
If you work at an organisation, treat any email asking you to click a link or enter a password with scepticism, even if it looks official. Report anything odd to your IT team. If you receive a breach notification letter from a company, change any password you share with that service elsewhere and watch your bank statements and credit file for unusual activity over the next 12 months. The shift here isn't subtle: the front door is now email, and most organisations haven't caught up.
