Topic starter
11/11/2026 6:05 pm
TL;DR: Ransomware spread through email first in most cases, with Barracuda finding that 69% of attacks began with a malicious message and many victims were hit more than once. That pattern makes mailbox security, credential protection and recovery readiness part of the same operational problem.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “2023 ransomware insights”.
By the numbers:
- 73% of organisations experienced a successful ransomware attack in 2022.
- 69% of ransomware attacks began with an email.
- 38% of organisations hit with ransomware in 2022 were repeat victims.
Key questions
Q: Why does a stolen email account help ransomware operators spread?
A: A stolen email account helps ransomware operators spread because it is a trusted internal channel for phishing, malicious attachments, link-based malware delivery and impersonation of the account owner.
Q: Why do phishing emails remain such a high-risk entry point for ransomware?
A: Phishing remains risky because it targets people directly and can bypass many technical controls by persuading someone to act.
Q: What should teams do immediately after discovering ransomware access?
A: Contain the identity path before focusing on payload cleanup.
Practitioner guidance
- Harden email authentication and phishing resistance Require stronger inbound mail controls, enforce MFA on all remote and cloud accounts, and treat stolen credentials as a likely next step after suspicious email activity.
- Reduce the blast radius of user and service accounts Review privilege on accounts that can reach backups, admin tooling and shared data so a compromised mailbox cannot become a domain-wide ransomware path.
- Tie recovery to credential revocation Build ransomware recovery playbooks that include password resets, token revocation, mailbox rule review and validation that the original entry path has been removed.
Bottom line: Ransomware is often a credential and access problem first, and an encryption problem second.
Glossary terms: Ransomware, Repeat Victimisation, Phishing, Credential Theft
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Email-delivered ransomware is really an identity compromise problem: the message is only the entry point. Once a user yields credentials or session access, the attacker is operating inside a trusted workflow rather than fighting perimeter controls. That shifts the security question from email hygiene alone to how accounts, privileges and authentication are governed across the environment. Practitioners should treat mailbox compromise as the start of an identity incident, not the end of a phishing case.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: What controls reduce repeat ransomware attacks?
A: Controls that reduce repeat ransomware attacks include restoring from offline or immutable backups, patching exposed systems, removing stale privileged accounts, enforcing multifactor authentication, segmenting networks and monitoring for new persistence mechanisms. Identity reviews, PAM for administrative access, email filtering and application allowlisting also help because many repeat infections start from the same weak credentials, remote access paths or unpatched entry points.
👉 Read our full editorial: Email-led ransomware drives repeat compromises across organisations