Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments
Semperis says ransomware gangs increasingly threaten staff with violence, doxxing and swatting to force payment.
Semperis's 2026 Ransomware Risk Report, based on 1,200 IT and security professionals, says ransomware gangs are adding physical and psychological intimidation to encryption and data-leak extortion. Forty percent of attacks involved such threats, and a quarter of campaigns now include them. Common methods were threatening messages, letters or packages (57%), threats against family and friends (37%), and threats to enter offices or homes (19%). Among affected organizations, 25% reported staff doxxing and 23% reported swatting, sometimes leading to relocation or psychological treatment.
- Survey covered 1,200 professionals in North America, the UK, Europe and Asia-Pacific.
- Forty percent of attacks included psychological or physical threats to staff.
- Reported tactics include doxxing in 25 percent and swatting in 23 percent.
- Threats are meant to force payment even when backups can restore systems.
Full article460 words · extracted from infosecurity-magazine.com · click to collapse
Ransomware gangs are increasingly turning to threats of physical violence against CISOs, business executives and other senior staff at the companies they attack in an effort to successfully extort payments from their victims, a new report has warned.
According to the Semperis 2026 Ransomware Risk Report, published on October 14, a quarter of ransomware campaigns now involve psychological or physical threats to members of staff at the company being targeted.
These threats are in addition to the extortion demand for a ransomware key to retrieve the encrypted data, as well as the threat of stolen data being leaked if the ransom isn’t paid.
This approach is referred to as triple extortion.
Overall, 40% of attacks involved psychological or physical threats against staff at the company being targeted, an increase compared with the previous year.
Some of the most common forms of intimidation used by ransomware gangs in these scenarios include sending staff at the victim organization threatening messages, letters or packages (57%), threatening family and friends of employees (37%) and threats of physical intrusions into offices or even homes (19%).
This additional layer of intimidation is designed to force victims of ransomware attacks into paying. Even if an organization is confident it could restore its network from backups, the threat of physical or emotional violence against its staff could encourage the payment of a ransom anyway.
“An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in,” said Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor.
“Holding you at physical risk is the latest phenomenon because we've covered most of the other risks.”
Doxxing, Swatting and Other Threats
Unfortunately, the threats by ransomware groups against employees of their victims have resulted in very real consequences. Of those organizations affected by ransomware gangs employing these tactics, 25% said their staff had been doxxed by attackers, while 23% suggested that employees had been swatted as part of the extortion campaigns.
The consequences of these attacks have ranged from companies having to support employees through psychological treatment and in some cases, the victim of the doxxing or swatting attack has moved home.
All of this involves a significant amount of emotional trauma for the individuals being targeted, while the stress caused can also impact individuals throughout the business.
“Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm,” said Mickey Bresman, Semperis CEO.
The Semperis research was based on a survey of 1,200 IT and security professionals across North America, the UK, Europe and the Asia-Pacific.