Semperis Report: Ransomware Gangs Escalate to Physical Threats Against Staff
A new report finds that 40% of ransomware attacks now include psychological or physical intimidation tactics aimed at company executives and employees.
Key points
- Forty percent of attacks involve threats against staff, up from the previous year.
- Common tactics include sending threatening packages, doxxing, and swatting incidents.
- These physical risks aim to force payments even when technical backups exist.
Ransomware operators are increasingly leveraging threats of physical violence and psychological intimidation to coerce organizations into paying ransoms, according to the Semperis 2026 Ransomware Risk Report. Published on October 14, the report indicates that a significant portion of recent campaigns now target the personal safety of employees rather than relying solely on data encryption or leakage threats.
The data reveals that 40% of attacks involved psychological or physical threats against staff members at targeted companies, marking an increase compared with the previous year. Specifically, a quarter of all ransomware campaigns now incorporate these intimidation tactics alongside traditional demands for decryption keys and threats to publish stolen data. This multi-layered approach is commonly referred to as triple extortion.
Escalation of Intimidation Tactics
Attackers employ various methods to instill fear in victims, with sending threatening messages, letters, or packages being the most common tactic at 57%. Threats directed at the family and friends of employees accounted for 37% of cases, while threats of physical intrusion into offices or private homes occurred in 19% of incidents. These actions are designed to make the cost of resisting demands higher than the cost of compliance.
Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor, noted that attackers seek to extract value by increasing the perceived risk of resistance. He stated that holding individuals at physical risk represents the latest phenomenon because other digital risks have largely been addressed by defenders. This strategy aims to force payments even if an organization possesses viable backups.
Real-World Consequences for Employees
The shift toward physical threats has resulted in tangible harms for employees of targeted organizations. According to the report, 25% of affected organizations said their staff had been doxxed by attackers during these campaigns. Additionally, 23% of respondents indicated that employees had been subjected to swatting, where false emergency reports are made to trigger police raids.
These incidents have forced companies to provide psychological treatment support for affected staff. In some severe cases, employees who were victims of doxxing or swatting had to relocate their homes. While Dark Reading reported that such claims of stalking and abduction are difficult to verify independently, the Semperis data highlights a clear trend toward personal intimidation as a primary extortion lever.
What should you do?
Security leaders must recognize that technical defenses alone may not prevent ransomware payments if staff face personal threats. Organizations should assess their incident response plans to include protocols for protecting employee privacy and safety. Monitoring for signs of doxxing or harassment is essential during an active breach.
What to do and how to stay safe: Semperis
- Review incident response plans to include specific procedures for protecting employee personal information and physical safety during a breach.
- Ensure that employee contact details and home addresses are not stored in easily accessible, unsecured systems that could be exfiltrated.
- Establish clear communication channels for employees to report threats, harassment, or suspicious contact immediately during an incident.
- Coordinate with local law enforcement beforehand to understand protocols for responding to potential swatting or physical intrusion threats.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of ransomware attacks now involve threats against staff?
According to the Semperis 2026 Ransomware Risk Report, 40% of attacks involved psychological or physical threats against staff, an increase from the previous year.
What are the most common forms of physical intimidation used?
The most common tactic is sending threatening messages, letters, or packages (57%), followed by threats against family and friends (37%) and threats of physical intrusion (19%).
Have these threats resulted in real-world harm?
Yes, 25% of affected organizations reported staff being doxxed, and 23% reported employees being swatted, with some victims needing to move homes.
