India, July 17 -- Compromised identities have become the leading entry point for ransomware attacks in India, according to the India findings of Sophos' seventh annual State of Ransomware 2026 report.

The vendor-agnostic study, which surveyed IT and cybersecurity leaders across 17 countries, found that more than four in five ransomware incidents in India (81%) began with compromised identities, slightly above the global average of 79%.

The findings indicate a shift in ransomware tactics away from exploiting software vulnerabilities towards identity-based attacks and social engineering techniques.

Exploited vulnerabilities are no longer the leading root cause of ransomware incidents in India. Instead, malicious emails accounted for 28% ...