Ransomware operators are adopting increasingly aggressive tactics and extending their reach beyond corporate environments by directly threatening the families of employees. This alarming trend is highlighted in the Semperis 2026 Ransomware Risk Report, which reveals that the face of cyber extortion is evolving with the leading edge of technology.
Among the respondents surveyed, 37% reported experiencing direct threats to their family members or friends, which brings a new level of intimidation to the already dire scenario posed by ransomware attacks. Even more concerning, 84% of participants indicated that they encountered attacks that incorporated artificial intelligence (AI) in some form. This shift in tactics shows that cybercriminals are not only becoming more sophisticated in their methods but are also willing to escalate threats to weigh heavily on the emotional and psychological well-being of their victims.
These findings are drawn from a comprehensive survey conducted by Censuswide, which gathered responses from 1,200 IT and security professionals across nine countries and eight different industries during the first half of 2026. Notably, the study focused exclusively on organizations that had experienced successful ransomware attacks that disrupted their business operations, providing a targeted insight into the severity and impact of these cyber threats.
The report underscores that traditional extortion tactics are still prevalent. A significant 56% of respondents encountered threats involving data erasure, destruction, or unauthorized release. Other forms of intimidation reported included blackmail, extortion, or public shaming, with 41% reflecting this experience. Notably, 40% of respondents encountered system lockouts or operational sabotage as part of the pressure tactics used by attackers. However, the introduction of personal threats aimed directly at individuals marks a worrying trend in the ransomware landscape.
Personal threats manifested in various forms, including threatening texts, letters, or packages that were reported by 57% of respondents. There were also chilling reports detailing threats of physical intrusion (19%), abduction (17%), and bodily harm (13%). It is crucial to note that these figures pertain to reported threats rather than confirmed incidents of kidnapping or physical assault.
These assaults on personal life resonate deeply, with about a quarter of respondents indicating they had experienced doxxing, which means the release of personal information that endangers individuals and their families. Additionally, 23% reported incidents of swatting, where false emergency reports were fabricated to dispatch law enforcement to a target’s home. The psychological toll of these threats has led 25% of respondents to seek medical or psychological treatment, and 14% have had to relocate their jobs, homes, or offices.
In an unsettling statistic, 53% of respondents conveyed that attackers carried out threats in the previous year, although the report did not specify whether this percentage reflected confirmed acts of violence or intimidation.
The report further illustrates that AI is rapidly changing the dynamics of cyber attacks, with 40% experiencing AI-based attacks. Moreover, 44% noted that their own AI systems or agents were exploited by attackers. The distinction is essential in understanding that while attackers are leveraging advanced technologies in their strategies, the security infrastructures of enterprises are also becoming a target.
Tomer Bar, the security research executive at Semperis, has raised alarms regarding the capabilities of large language models. These sophisticated tools can assist attackers in fine-tuning their code and minimizing errors in encryption processes. Former U.S. National Cyber Director Chris Inglis echoed these sentiments, noting that the advancements in AI have increased both the speed and complexity of ransomware campaigns. However, while these insights accompany survey findings, the report refrains from attributing specific technical details to individual cyber incidents.
Defensive measures utilizing AI have yielded mixed results. While nearly half (49%) of respondents successfully employed AI for real-time detection or response, 23% revealed that their AI systems faltered, failing to adequately respond to threats.
Inevitably, identity infrastructure has become a primary target for ransomware gangs, with 87% of surveyed cases involving exploits of identity management systems. Key targets included Active Directory (51%), Microsoft Entra ID (48%), and Okta (27%). Despite the clear threats posed to access and privilege management systems, only half of the organizations maintained dedicated backups for their identity data, and a mere 42% had automated identity recovery solutions in place. The report warns that inadequate preparation for recovery could leave organizations vulnerable to continuous access from attackers, complicating efforts to return to a secure state.
The report reveals a troubling trend of repeat attacks—69% of organizations reported experiencing multiple successful attacks, and 59% had paid ransom at least once. Alarmingly, almost a quarter of those who paid reported being unable to eradicate the attackers from their systems.
In response to these evolving threats, the report recommends that organizations limit AI agents’ access to identity infrastructure and rigorously document identity recovery procedures. Additionally, conducting comprehensive training for realistic crisis scenarios and developing response plans that include alternative communication channels and pre-established contacts with law enforcement can significantly enhance preparedness for threats against employees and their families. The report emphasizes that personal safety is an integral facet of any organization’s cyber resilience strategy.
With the ramping up of these sophisticated approaches to extortion, it is evident that businesses must continuously refine their defenses to withstand the relentless evolution of ransomware attacks, integrating the latest intelligence and proactive strategies to combat these emerging threats.