Semperis Survey Ties Ransomware to Unverified Threat Claims

Semperis' 2026 survey of 1,200 professionals reports ransomware-linked intimidation, but Dark Reading says the violence figures were not corroborated.

Semperis' 2026 Ransomware Risk Report, based on 1,200 IT and security professionals in North America, the UK, Europe and Asia-Pacific, says ransomware groups are adding physical and psychological intimidation to encryption and data-leak extortion. Infosecurity Magazine reports that 40% of attacks involved such threats and that a quarter of campaigns now include them, while Dark Reading describes a combined two in five respondents reporting intimidation, with 23% citing psychological intimidation and 17% citing physical threats this year versus 40% reporting physical threats in 2025. Infosecurity lists common methods as threatening messages, letters or packages (57%), threats against family and friends (37%), and threats to enter offices or homes (19%), and says 25% of affected organizations reported staff doxxing and 23% reported swatting, sometimes leading to relocation or psychological treatment. Dark Reading says more than half of respondents claimed attackers carried through on threats, but stresses the figures are self-reported and that neither Semperis nor Dark Reading corroborated actual violent attacks. The outlets therefore differ both in percentages and in framing: Infosecurity presents the tactics as an extortion method meant to force payment even when backups work, while Dark Reading treats the violence and stalking claims as unverified.

• Semperis' 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals in North America, the UK, Europe and Asia-Pacific.
• Dark Reading: about two in five respondents reported intimidation tied to ransomware; this year 23% cited psychological intimidation and 17% physical threats, versus 40% reporting physical threats in 2025.
• Infosecurity Magazine: 40% of attacks involved psychological or physical threats, while also stating that a quarter of campaigns now include them.
• Reported methods include threatening messages, letters or packages (57%), threats against family and friends (37%), and threats to enter offices or homes (19%).
• Among affected organizations, Infosecurity reports staff doxxing in 25% and swatting in 23%, sometimes leading to relocation or psychological treatment.
• Dark Reading says more than half claimed attackers carried through on threats, but the self-reported figures were not corroborated by Semperis or Dark Reading.
• Threats are described as intended to force payment even when backups can restore systems.