Semperis Survey Links Ransomware to AI, Identity, and Family Threats

Semperis’s survey of 1,200 ransomware victims finds AI in 84% of cases, identity systems targeted in 87%, and threats to friends or family in 37%.

Semperis’s 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals whose organizations had suffered ransomware. Sources disagree on the sample: GBHackers describes disruptive incidents and stresses that findings are self-reported rather than forensic proof, while Cyber Security News and DataBreaches.net describe successful attacks in the prior year or prior 12 months; CSO Online places the survey in early 2026 across nine countries, and DataBreaches.net adds eight sectors and first-half 2026 fieldwork. Across the reports, 84% of victims reported AI involvement and 87% said identity infrastructure was targeted; GBHackers specifies Active Directory (51%), Microsoft Entra ID (48%), and Okta (27%), whereas Cyber Security News states the 87% as targeting of those three systems without separate shares. Repeat attacks hit 69%, 59% paid at least once, only half kept dedicated identity backups, and Okta recovery procedures covered 28%. Personal extortion figures are consistent in the later reports: 37% reported threats against friends or relatives, 57% reported threatening texts, letters, or packages, and threats were carried out in 53% of cases, alongside intrusion (19%), abduction (17%), and bodily-harm (13%) threats, doxxing (25%), swatting (23%), and medical or mental-health needs (25%). CSO Online, not restated by DataBreaches.net, adds that 41% reported physical or psychological intimidation and 44% reported manipulation of their own AI agents.

• Semperis’s 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals whose organizations had suffered ransomware; sources differ on “disruptive” versus “successful” attacks and on timing (prior year, prior 12 months, early…
• 84% of respondents reported some AI involvement; GBHackers says the results are self-reported experiences, not forensic proof of AI use.
• 87% reported identity-infrastructure targeting; GBHackers breaks this out as Active Directory 51%, Microsoft Entra ID 48%, and Okta 27%, while Cyber Security News states the 87% as targeting of those systems.
• 69% were attacked more than once, 59% paid ransom at least once, 50% kept dedicated identity backups, and Okta recovery procedures covered 28%.
• 37% said attacks included threats against friends or relatives; 57% reported threatening texts, letters, or packages, with threats carried out in 53% of cases.
• Reported threat types also included intrusion (19%), abduction (17%), and bodily harm (13%); impacts included doxxing (25%), swatting (23%), and medical or mental-health care (25%).
• CSO Online separately reports physical or psychological intimidation in 41% of cases and manipulation of victims’ own AI agents in 44%, and cites phishing-resistant MFA, least privilege, and human approval for agents.