Ransomware Gangs Target Employees' Families in Extortion Push

As of 15 October 2026, ransomware extortion has moved beyond locked files and leaked data to direct threats against employees and their families, according to Semperis's 2026 Ransomware Risk Report. The study drew on responses from 1,200 IT and security professionals in nine countries; 41% of organisations hit by a successful ransomware attack reported physical or psychological intimidation, and 37% said attackers threatened employees' friends or relatives. Attackers followed through on their threats in 53% of reported cases, according to the survey.

On 3 September 2026, Barracuda published a blog warning that cyberattacks were increasingly paired with threats of physical harm against staff, executives and sometimes families, as payment rates decline and attackers escalate. Barracuda noted that attackers gather home addresses and information about families to intensify pressure, so the attack surface now reaches into employees' personal lives.

Dark Reading reported on 14 October that it could not find a single documented case of violence carried out in service of a ransomware attack, and Semperis could not corroborate the self-reported figures. The publication noted the data "must be met with caution" until proven cases surface. Jeff Wichman, Semperis director of incident response, told Dark Reading that physical harm "in some way, shape, or form, it does happen," but no case was identified.

What the survey found

The Semperis report details the methods. Threatening texts, letters or packages were reported by 57% of respondents; 19% faced threats of physical intrusion, 17% threats of abduction, and 13% threats of bodily harm. One quarter reported employees or family members were doxxed, and 23% reported swatting. Around 25% reported that employees or family members needed medical or psychological treatment, 24% hired additional security, and in 14% of cases staff or relatives had to change jobs, office locations or homes.

Singapore respondents reported even more personal pressure: 56% of firms said threatening texts, letters or packages were sent to workers' homes or offices, 41% reported threats against family or friends, and 14% reported threats of abduction, according to HRD's coverage of the report. Nearly half of Singapore respondents said threats involved blackmail, extortion or public shaming, and 66% said hackers threatened to file regulatory complaints if incidents went unreported.

AI and identity risks

Artificial intelligence is present in most attacks, the survey says. 84% of respondents said attacks involved AI in some way, while 44% reported that attackers manipulated or exploited the victim's own AI agents or systems. Devroop Dhar, who leads Primus Partners, told CSO that AI helps attackers quickly combine public social media profiles, data broker records and leaked data to build personalised threats. Courtney Guss of Semperis added that weakly secured AI agents can become "a ticking time bomb" because agents that seek permissions may compromise identity systems.

The legal and employer obligations are shifting. Chris Inglis, a former US national cyber director who advises Semperis, called threats aimed at corporate employees outside the workplace "an unusual new phenomenon". HR leaders are being drawn in because they manage employee data control, regulatory compliance and employee education, and can decide how the organisation responds to regulatory data violations, according to HRD. According to HRD's coverage, 18% of Singapore respondents said attacks led to layoffs, resignations or dismissals, and the same share reported fines or lawsuits.

Response planning

Response planning needs to extend outside the network. Barracuda recommends merging cyber incident response with physical security, HR and crisis management, and conducting tabletop exercises that blend cyber and physical scenarios. Gerry Sillars of Semperis said organisations should treat AI agents as part of the attack surface with identity controls, permissions and monitoring, and include staff safety and law-enforcement contact in crisis plans. CSO's closing guidance suggests setting up a confidential channel for employees to report intimidation and running tabletop exercises that simulate compromised identity systems, threatened leaks and threats against employees' families. On the technical side, the report highlights that 87% of attacks targeted identity infrastructure such as Active Directory, Entra ID or Okta, but only 50% of respondents had dedicated identity backups and 42% had automated identity recovery tools. The FBI opposes paying ransoms, and the survey reported that 59% of victims paid at least once while 69% experienced more than one successful attack.