Identity Attacks Now Top Ransomware Entry Point in 2026

A Fundamental Shift in How Ransomware Begins

For years, cybersecurity teams have treated patch management as the single most important defense against ransomware, racing to close software vulnerabilities before attackers could exploit them. That calculus is changing. Sophos' State of Ransomware 2026 report finds that 79% of ransomware incidents now begin with compromised user identities rather than exploited software flaws, the first time in four years that identity-based intrusion has overtaken traditional vulnerability exploitation as the leading entry point 1. The finding suggests that stolen credentials, phished logins, and hijacked authentication tokens have become more reliable pathways into corporate networks than zero-days or unpatched systems, forcing a rethink of where security budgets and attention should go.

The Numbers Behind a Growing Crisis

The shift in tactics is unfolding against a backdrop of surging attack volume. A Black Kite report released in late July 2026 recorded 7,551 ransomware victims between April 2025 and March 2026, a 24.9% year-over-year increase, with 146 active ransomware groups now operating in the criminal ecosystem 2. That proliferation of groups appears to be intensifying competition for victims rather than diluting the threat. Reporting on the rivalry between the Qilin and The Gentlemen ransomware gangs indicates that small and mid-sized businesses (SMBs) are bearing the brunt of this competitive pressure, facing attacks at a higher rate than ever as gangs jostle for market share among softer, less-defended targets 3.

Attackers Are Also Chasing New Kinds of Assets

Ransomware operators are not only changing how they get in, they are also expanding what they encrypt. A newly identified strain called ENCFORGE, deployed by a group tracked as JADEPUFFER, exploits a remote code execution flaw in Langflow (CVE-2025-3248) to target AI infrastructure directly, encrypting model weights, vector indexes, and training data rather than conventional files 4. This marks a notable evolution: as organizations invest heavily in AI systems, those systems themselves are becoming attractive, high-value targets, and unpatched AI tooling represents exactly the kind of vulnerability that identity-based attacks are increasingly bypassing entirely.

Real-World Fallout: Schools and Local Institutions

The human cost of this rising volume is visible in everyday disruptions far from corporate boardrooms. In Minnesota, the Delano school district became the latest in a string of districts to suffer a ransomware-linked cyber incident, forcing the cancellation of classes 5. Such incidents underscore that ransomware is no longer solely a concern for large enterprises with sensitive financial data; schools, municipalities, and other under-resourced public institutions are frequent casualties, often lacking the identity-security infrastructure, such as multi-factor authentication and privileged access controls, that larger organizations are beginning to prioritize.

Why It Matters

Taken together, these developments point to a threat landscape that is both broadening and specializing. Attackers are diversifying their entry methods toward identity compromise, multiplying in number, competing over SMB targets, and expanding into novel territory like AI infrastructure. For defenders, the message is that patching alone is no longer sufficient; identity governance, credential hygiene, and monitoring for anomalous logins now deserve equal footing with traditional vulnerability management.