The New Ransomware Reality
For years, many people pictured cyberattacks as something dramatic: a hacker breaking through a firewall, exploiting a server, or using advanced code to force their way into a network. Those attacks still happen, but ransomware has been changing. One of the biggest shifts in 2026 is that ransomware attacks are increasingly connected to identity compromise. In other words, attackers are often not breaking through the front door. They are finding someone’s key and walking in.
Identity Is Now a Primary Target
Sophos reported that compromised identities are now the dominant initial access vector for ransomware attacks, with four in five attacks starting with compromised identities in its 2026 ransomware research. The report also noted that malicious email and phishing have moved ahead of exploited vulnerabilities as common root causes. For business leaders, that is an important change. It means that ransomware prevention cannot focus only on patching, antivirus, and firewalls. Those still matter, but identity security now sits at the center of the conversation.
What Identity Security Really Means
Identity security is the protection of user accounts, passwords, authentication methods, permissions, and access behavior. Every employee account is a potential pathway into company systems. If an attacker steals a username and password, tricks a user into approving a login, or compromises an account connected to email or cloud storage, the attacker may be able to move through the organization using what looks like legitimate access. That makes the attack harder to spot than a traditional malware infection.
How Attackers Steal Access
Phishing remains one of the easiest ways for attackers to steal access. A user receives an email that looks like a Microsoft sign-in request, a shared document notification, a courier notice, or a voicemail alert. The link leads to a fake login page, and the user enters their credentials. In some attacks, the attacker immediately reuses those credentials. In others, they wait, collect more information, and look for a better opportunity. If the account has access to email, files, finance records, or administrator tools, the damage can grow quickly.
Why MFA Still Matters — But Isn’t Enough by Itself
Multifactor authentication, commonly called MFA, is still one of the most important security controls, but the ransomware data shows that MFA alone is not a complete solution. Sophos noted that MFA was present in many incidents where compromised credentials were the root cause, which highlights a key point: coverage gaps, weak MFA methods, prompt fatigue, and account misconfigurations can still leave organizations exposed. MFA is essential, but it needs to be deployed correctly, monitored, and combined with other protections.
Coverage Gaps Create Risk
A common mistake is assuming that turning on MFA for some users is enough. In reality, every account with meaningful access should be considered. That includes administrators, executives, finance staff, remote workers, shared mailboxes, service accounts, and sometimes third-party accounts. Attackers do not always target the most obvious person. They may target the easiest account that gives them a foothold. Once inside, they can search email, look for passwords, identify system names, and move toward more sensitive areas.
Least Privilege: Give Users Only What They Need
Permissions are another major factor. Many businesses accumulate access over time. An employee changes roles but keeps old permissions. A temporary project folder becomes permanent. A former vendor account remains active. A shared account is used because it is convenient. These situations create risk because an attacker who compromises one account may gain access to far more than that user actually needs. The principle of least privilege is simple: users should have the access they need to do their job, but not much more.
Monitoring for Suspicious Sign-ins and Account Behaviour
Identity-based ransomware also changes the importance of monitoring. If an attacker logs in using valid credentials, the login may not immediately look suspicious. But there may be signs: unusual login locations, impossible travel patterns, unexpected device types, login attempts outside normal hours, repeated failed attempts, new mailbox rules, suspicious forwarding, or sudden access to large numbers of files. Tools such as Microsoft Entra ID, Conditional Access, endpoint protection, and managed detection services can help identify these patterns.
Email Compromise Can Be a Warning Sign
Business email compromise is closely related to this issue. Once an attacker has access to a mailbox, they may not deploy ransomware right away. They may read conversations, learn how invoices are paid, watch for large transactions, create forwarding rules, or impersonate the user. This can lead to fraud, data exposure, and reputational damage. In some cases, attackers use email access to move further into the environment by resetting passwords or sending malicious messages from a trusted internal account.
Password Hygiene Still Counts
Strong password practices still matter. Password managers can help users create unique, complex passwords without having to memorize them. Reusing passwords across websites is dangerous because one breached website can expose credentials used elsewhere. Businesses should encourage or require unique passwords, block known weak passwords, and make it easy for users to report suspicious login prompts.
User awareness is also important, but it should not be the only defense. Employees need to know what phishing looks like, how to report suspicious emails, and why login prompts should be treated carefully. However, even well-trained people can make mistakes, especially when messages are convincing or urgent. Security should be designed with the assumption that someone may eventually click the wrong link. The goal is to limit the damage when that happens.
Backups Must Be Protected Too
Backups remain essential in ransomware defense, but identity attacks can threaten backups too. If attackers gain administrator access, they may try to delete backups, disable protection, or change retention settings before launching ransomware. This is why businesses should use protected backups, immutable storage where appropriate, offline or isolated copies, and tested recovery procedures. A backup that has never been tested is only a hope, not a recovery plan.
Practical Questions Every Business Should Ask
A practical identity security program does not have to be overwhelming. Start with a few key questions: Is MFA enforced for all users? Are administrator accounts protected with stronger controls? Are legacy authentication methods disabled? Do users have more access than they need? Are guest and vendor accounts reviewed? Are mailbox forwarding rules monitored? Are risky sign-ins reviewed? Are backups protected from account compromise? These questions can reveal gaps quickly.
The shift from exploit-based ransomware to identity-driven attacks also makes cyber insurance and compliance conversations more important. Insurers increasingly ask about MFA, endpoint detection, backups, patching, and security monitoring. Customers and partners may ask similar questions. A business that can show it has strong identity controls is in a better position than one that cannot explain how accounts are protected.
For SMBs, the good news is that many of the most important identity protections are achievable. Microsoft 365 environments already include many tools that can help, depending on licensing and configuration. A managed service provider can help review current settings, identify gaps, and build a roadmap that matches the organization’s size, risk, and budget.
Ransomware is no longer only a malware problem. It is an identity problem, a process problem, and a resilience problem. If attackers can log in as a legitimate user, they may bypass many traditional defenses. That is why businesses need to protect identity as carefully as they protect servers and data.
At DMS iTech, we recommend treating user accounts as critical business assets. Protect them with strong authentication, review permissions regularly, monitor suspicious activity, train staff, and maintain resilient backups. The message is simple: if hackers are trying to log in instead of break in, your login security needs to be strong enough to stop them.
