Semperis Report: Ransomware Gangs Threaten 37% of Victims’ Families
A new survey reveals attackers are targeting employees’ relatives with physical threats and doxxing to force ransom payments during cyberattacks.
Key points
- Attackers threatened family members at 37% of surveyed organizations that suffered ransomware attacks.
- One-quarter of respondents reported employees needing medical or psychological care due to these threats.
- Sixty-nine percent of organizations experienced multiple successful ransomware attacks within the previous year.
Ransomware criminals are increasingly targeting the personal lives of employees to pressure companies into paying ransoms, according to Semperis’ 2026 Ransomware Risk Report. The survey found that attackers threatened family members or friends at 37% of the organizations included in the study. This data comes from 1,200 IT and security professionals at companies that had each experienced at least one successful ransomware attack.
The report highlights a shift in tactics where criminal syndicates inflict both cyber and physical harm to generate cash. Mickey Bresman, Semperis CEO, stated that attackers show no hesitation in using these aggressive methods. Respondents described receiving threatening messages, being stalked, and facing direct threats of physical violence. These tactics are designed to increase pressure on both the employees and their employers to meet ransom demands quickly.
Escalation of Personal Harassment
The consequences of these threats extend beyond digital harassment into real-world safety issues. According to the survey, 23% of organizations reported incidents of swatting, where false emergency reports are made to send police to a victim’s location. Doxxing was another common consequence, with attackers exposing personal information online without consent. Some employees were forced to change jobs, offices, or homes following an attack, while others required security protection to ensure their safety.
Tim Beasley, a Senior Incident Response Consultant at Semperis, noted the severe mental toll these events take on staff. He observed that IT and cybersecurity personnel already deal with high stress levels, which ransomware attacks exacerbate significantly. Beasley reported seeing CISOs resign because the pressure became unbearable, with some leaving because leadership blamed them for mismanagement that led to the breach.
Operational Recovery Challenges
The frequency of these attacks remains high, with 69% of surveyed organizations experiencing multiple successful ransomware attacks within the previous year. Restoring operations after an incident is complex, requiring teams to identify entry points, remove attacker access, and verify restored systems. Malware, backdoors, and compromised accounts can provide intruders with a way back into the organization if not fully addressed.
Pressure to resume business operations can lead companies to restore services before confirming that attackers have been completely removed. This rush to recover can leave vulnerabilities open, allowing criminals to re-establish access. The report recommends documenting response roles across the organization and including procedures for threats against people outside the workplace. Establishing relationships with law enforcement before an incident occurs is also advised to help manage these complex situations.
What should you do?
Organizations should review their incident response plans to include protocols for handling threats against employees’ families. Security teams should establish relationships with local law enforcement agencies prior to any incident to facilitate quicker response times. Monitoring for signs of doxxing or swatting attempts is crucial for protecting staff well-being. Additionally, leadership should support mental health resources for IT staff dealing with the stress of active attacks.
What to do and how to stay safe: Semperis
- Update incident response plans to include specific procedures for handling threats against employees’ family members and friends.
- Establish pre-incident relationships with local law enforcement to ensure rapid response if swatting or physical threats occur.
- Monitor social media and public records for signs of doxxing or unauthorized exposure of employee personal information.
- Provide mental health support and clear communication channels for IT staff managing the stress of active ransomware incidents.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of organizations faced threats against employees' families?
According to the Semperis 2026 Ransomware Risk Report, attackers threatened family members or friends at 37% of the surveyed organizations.
What is swatting in the context of ransomware attacks?
Swatting involves making false emergency reports to send police to a person’s location, a tactic reported by 23% of surveyed organizations.
How many organizations experienced multiple ransomware attacks in the previous year?
Sixty-nine percent of the surveyed organizations experienced multiple successful ransomware attacks within the previous year.
