Ransomware gangs threaten employees’ families in new extortion tactics
A new report reveals attackers are using AI and personal intimidation against staff and their relatives to force ransom payments.
Key points
- Semperis data shows 84% of ransomware victims faced AI-involved attacks in 2026.
- Thirty-seven percent of respondents reported threats against employees’ friends or family.
- Identity infrastructure was targeted in 87% of the surveyed ransomware incidents.
Ransomware operators are increasingly targeting the personal lives of corporate employees and their families to pressure organizations into paying ransoms, according to a new report. This shift marks a departure from traditional tactics that focused solely on encrypting corporate data or threatening to leak stolen information.
The Semperis 2026 Ransomware Risk Report, published in the first half of 2026, details this escalation. The survey of 1,200 IT and security professionals across nine countries found that attackers are leveraging artificial intelligence and exploiting identity infrastructure. Respondents reported that 84% of victims experienced attacks involving AI, while 87% faced threats directed at identity systems.
Expanding Extortion Tactics
As organizations improve their backup and recovery capabilities, attackers have evolved beyond simple file encryption. They now frequently employ double extortion, combining data theft with threats to publish stolen information. The latest development involves extending pressure beyond corporate networks to the people connected to the targets.
The report indicates that 41% of respondents encountered physical or psychological intimidation during attacks. Additionally, 37% stated that employees’ friends or family members were directly threatened. These tactics include threatening texts, letters, packages, and even physical intrusion or stalking, aiming to distract employees and increase psychological pressure on the organization.
Impact on Employees
The personal nature of these attacks has severe consequences for victims and their households. The survey found that 25% of respondents said employees or family members were doxed, with their identities revealed online without consent. Another 23% reported experiencing swatting, where fabricated emergency reports led to law enforcement dispatching officers to a victim’s location.
The human cost is significant, with 25% of respondents noting that employees or family members required medical or psychological treatment. Approximately 24% said their organizations hired additional security in response. Furthermore, 14% reported that employees were forced to change jobs, move offices, or relocate their homes due to the threats.
What should you do?
Security leaders should review incident response plans to include protocols for protecting employees’ personal safety. Organizations should assess their identity infrastructure for vulnerabilities, as it remains a primary target. Monitoring for signs of AI-driven attacks and educating staff on recognizing social engineering attempts are also critical steps.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Semperis
- Review and update incident response plans to include procedures for protecting employees and their families from physical or psychological threats.
- Conduct a comprehensive audit of identity infrastructure to identify and mitigate vulnerabilities that attackers frequently target.
- Implement monitoring tools to detect unusual AI-driven activities or anomalies that may indicate an ongoing ransomware attempt.
- Educate employees on recognizing signs of social engineering, doxing, or swatting attempts so they can report them immediately.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of ransomware victims faced AI-involved attacks?
According to the Semperis 2026 Ransomware Risk Report, 84% of surveyed ransomware victims experienced attacks involving artificial intelligence.
How are attackers extending pressure beyond corporate networks?
Attackers are using physical intimidation, threatening employees’ friends and family, doxing, and swatting to pressure companies into paying ransoms.
What sectors were included in the Semperis survey?
The survey covered eight sectors, including finance, healthcare, manufacturing, critical infrastructure, and government, across nine countries.
