Dark Reading says Semperis claims of ransomware-linked violence and family stalking remain unverified.
Dark Reading reviews Semperis’ 2026 Ransomware Risk Report, in which a combined two in five respondents reported intimidation or threats associated with ransomware, including stalking, violence, and abduction. This year 23% cited psychological intimidation and 17% physical threats, compared with 40% reporting physical threats in 2025. More than half said attackers carried through on threats. The article stresses that the figures are self-reported and that neither Semperis nor Dark Reading corroborated actual violent attacks.
About two in five Semperis respondents reported intimidation tied to ransomware.
Physical threats were 17% this year, versus 40% in the 2025 survey.
More than half claimed attackers carried through on threats they made.
Dark Reading says the self-reported violence figures were not corroborated.
Ransomware actors have been threatening their victims with physical violence, according to new survey data. Many are reporting actual physical attacks being carried out in service of ransomware extortions, though hard data substantiating these claims is missing.
A combined two out of every five organizations that participated in Semperis's newly released 2026 Ransomware Risk Report indicated they had faced intimidation and threats associated with their ransomware attacks, and often severe ones. Even more remarkably, more than half of respondents claimed that attackers "carried through on threats" they made.
Semperis's study relied on self-reporting, and it couldn't corroborate these alarming figures, nor could Dark Reading. If true, the data suggests that ransomware is escaping the digital realm and becoming a genuine risk to victims' safety. Unless and until proven cases of violent attacks surface, however, the data must be met with caution.
It was last year when the realization first hit: Semperis started asking survey participants about physical threats to their organizations in its 2025 annual report, and a full 40% of participants said yes, they had received such threats from their hackers.
This year's data casts some confusion around the matter, as only 17% of 2026 respondents told surveyors that they'd been subject to physical threats. A further 23% reported psychological intimidation.
Among personal threats, threatening texts, letters, or packages (57% of those who reported being threatened in the first place) were most commonly experienced. Attackers also went much further, though, by threatening employees' family and friends (37%), physical intrusion into an organization's facilities (19%), abduction (17%), bodily harm (13%), and stalking (6%).
Worst of all, perhaps, is that 53% of survey respondents reported that their attackers actually carried out their threats.
Interestingly, these figures varied significantly between countries and industry verticals. In the UK, Semperis found that around 34% of ransomware groups' threats were carried out, and that victims might expect to be stalked 18% of the time. Hackers operating in Italy are exceptionally violent, apparently, as 32% of victims there were threatened with abduction and 22% with bodily harm, with 74% claiming that their threats were carried out.
Attackers have been finding other ways to make ransomware personal issues for their victims, too. According to Semperis, victims or their families were doxxed, swatted, or subjected to some other sort of public shaming in more than half of all cases.
Are Threat Actors Actually Physically Harming People?
Asked whether ransomware victims are actually being physically harmed, Jeff Wichman, Semperis’s director of incident response, states, "Yes. In some way, shape, or form, it does happen."
In reporting this story, however, Dark Reading failed to find even a single documented case of violence perpetrated in service of a ransomware attack. Asked for a case study, Semperis pointed to a Europol press release regarding so-called "violence-as-a-service," but Europol did not connect violence-as-a-service with ransomware. However, there is hard evidence that violence in cyberattacks exists in related ways.
First, physical violence is rife and increasing around cryptocurrency thefts. Back in February, Web3 security company CertiK Skynet published its annual report on so-called "wrench attacks." As the name implies, "wrench attack" is the cryptocurrency world's term to describe when attackers physically assault their targets in order to steal their cryptocurrency wallet private keys. CertiK Skynet documented 72 cases in 2025, which represented a 75% rise over 2024. Chainalysis found a similar "surge" of wrench attacks in 2025. Halfway through 2026, it found that violent attackers had successfully won $30 million worth of crypto.
What's true of cryptocurrency is not necessarily true of enterprise cyberattacks, of course. But cyber extortion groups do appear to dabble in physical intrusion. In spring 2026, the FBI and Mandiant researchers each documented the "Silent Ransom Group" posing as IT technicians to enter corporate offices and extract data from endpoints using USBs.
Lastly, it does seem the case that threats of violence are rising across online attacks generally (if not ransomware specifically). In its Internet Crime Report 2025, the FBI reported having received 1,360 complaints involving threats of violence, in cases that did not involve extortion. In 2025, it received 4,826 — a 250% rise year-over-year.
Why Hackers Turn to Physical Threats
Semperis has had firsthand experience with ransomware groups' threats. A few years ago, while representing a US government organization in a ransom negotiation, one of its own employees received a package on his doorstep with a note "alluding to physical violence if he didn't back off," the BBC reported.
Ironically, a rise in physical threats could be interpreted as a byproduct of improved organizational cybersecurity. "As attackers lose leverage with [extortion] — companies now are in the position of 'we've got this and this covering us' — now it's more about forcing that demand. 'You need to talk to us. We are serious,'" Wichman says.
"It will keep evolving just like anything else," he continues. "I look at it kind of like the days of the mafia. Originally, it was just about extorting money from businesses. Then it became: You didn't pay us, now we're going to get violent. Same old, same old."
Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.
He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.
He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.
Want more Dark Reading stories in your Google search results?
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Informa TechTarget|
