Ransomware gangs are increasingly resorting to threats of physical violence against Chief Information Security Officers (CISOs), business executives, and other senior staff in their relentless pursuit of extorting payments from victimized companies. A recent report has shed light on this alarming trend, highlighting the growing viciousness of such cybercriminal tactics.
Published on October 14, the Semperis 2026 Ransomware Risk Report lays bare the unsettling reality that a staggering quarter of new ransomware campaigns now involve explicit psychological or physical threats directed at the employees of targeted organizations. These threats are not merely additional pressures in what is already an intense situation; they form a core component of the extortive strategy employed by these hackers.
In the landscape of cyber extortion, these tactics are on top of demands for ransom payments aimed at securing a decryption key, which is necessary for victims to regain access to their encrypted data. Additionally, attackers often threaten to leak sensitive or stolen data if their ransom demands are not met. This multilayered strategy has been aptly termed triple extortion and presents a grim picture of the lengths to which these criminal groups will go to fulfill their objectives.
The report indicates a marked increase in the aggressiveness of attacks, with approximately 40% of all reported incidents now involving threats against company employees. This figure represents a significant rise compared to the previous year, signaling a dangerous trend that poses risks not only to organizational data but also to individual security and well-being.
Among the intimidation tactics employed by ransomware gangs, the most prevalent involve sending threatening messages, letters, or packages directly to employees of the organization (57%). In a disturbing twist, 37% of these criminals also threaten the family and friends of employees, while 19% escalate their intimidation by implying physical intrusions into the victims’ homes or offices. Such manipulation is intended to coerce victims into compliance, making it exponentially more challenging for organizations to stand firm against ransom demands. Even when companies believe they can restore networks from backups, the nagging fear of harm to staff often sways their decisions.
Chris Inglis, a former U.S. National Cyber Director and current Strategic Advisor at Semperis, elaborated on this chilling phenomenon. He remarked, “An attacker has one goal in mind: They want to extract something from you. And the only way they’re going to do that is to make the cost of resisting their demands greater than the cost of giving in.” According to Inglis, this latest trend of threatening physical harm showcases the evolution of ransomware attacks, as most other risks have already been substantially exploited.
The ramifications of these threats are starkly evidenced by statistics revealing that 25% of organizations caught in such extortion schemes experienced doxxing incidents, where personal information of employees was exposed. Furthermore, 23% of firms reported that their staff had been victims of "swatting," a dangerous practice involving false reports to emergency services to target individuals. The consequences of these attacks have been severe, often necessitating support for affected employees through psychological counseling. In some cases, individuals felt compelled to relocate to ensure their safety.
The emotional trauma inflicted on targeted individuals cannot be overstated; the anxiety from such threats spreads throughout organizations, impacting morale and productivity. Mickey Bresman, CEO of Semperis, underscored the grim reality, asserting that ransomware has become an increasingly lucrative endeavor for criminal syndicates, which show no hesitance in deploying both cyber and physical violence.
The findings presented in the Semperis research stem from a comprehensive survey conducted with 1,200 IT and security professionals across diverse regions, including North America, the UK, Europe, and the Asia-Pacific. These data points reflect a growing crisis in cybersecurity, highlighting urgent necessities for organizations to enhance their defenses against increasingly ruthless tactics employed by ransomware groups.
As ransomware threats escalate in complexity and severity, it is crucial for companies to adopt comprehensive strategies to mitigate risks and safeguard the well-being of their employees. The current environment demands not only technological solutions but also a holistic approach to security that prioritizes the physical and emotional safety of those on the front lines of this evolving battle against cybercrime.