Check for physical threats if your firm faces ransomware extortion
Ransomware groups are escalating tactics to include stalking and violence against staff, making personal safety a critical concern for employees.
Key points
- Forty per cent of attacks involved psychological or physical threats against staff, an increase from the previous year.
- Common tactics include threatening messages, doxxing personal details, and swatting incidents targeting employees.
- The Semperis 2026 Ransomware Risk Report highlights this shift toward triple extortion methods to force payments.
Employees at organisations targeted by ransomware gangs are increasingly facing dangers that extend beyond digital disruption. According to the Semperis 2026 Ransomware Risk Report, published on 14 October, attackers are using threats of physical violence and psychological intimidation against staff to compel ransom payments. This marks a significant escalation in how criminal groups pressure victims, moving from data encryption to direct personal harm.
What kind of threats are employees facing?
The report indicates that forty per cent of attacks involved psychological or physical threats against staff at the company being targeted. This represents an increase compared with the previous year. Attackers are not just demanding money for decryption keys or threatening to leak stolen data; they are adding a layer of personal intimidation. This strategy, known as triple extortion, aims to make the cost of resisting the attack higher than the cost of paying the ransom by targeting the well-being of individuals.
Which staff members are targeted and how?
Threats are directed at CISOs, business executives, and other senior staff members. The most common form of intimidation involves sending threatening messages, letters, or packages to employees, which occurred in fifty-seven per cent of these scenarios. Attackers also threaten the family and friends of staff in thirty-seven per cent of incidents. In nineteen per cent of cases, there were threats of physical intrusions into offices or private homes, creating a pervasive sense of vulnerability for those involved in the response.
Have these threats resulted in real-world harm?
Yes, the consequences extend beyond mere threats. Among organisations affected by these tactics, twenty-five per cent reported that their staff had been doxxed by attackers, exposing private personal information online. Additionally, twenty-three per cent stated that employees were subjected to swatting, a tactic where false emergency reports are made to send armed police to a victim's location. These actions have led to real-world impacts, including the need for psychological treatment and some employees having to move their homes for safety.
Why are attackers changing their tactics?
Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor, explained that attackers aim to extract value by making resistance too costly. He noted that holding individuals at physical risk is the latest phenomenon because other risk vectors have been largely exhausted. By threatening physical or emotional violence, gangs hope to bypass an organisation's technical defences, such as backups, and force a payout through fear rather than technical leverage.
What affected people can do
If your organisation is targeted, treat personal safety as a priority alongside technical recovery. Monitor your communications for suspicious packages or messages, and verify the identity of anyone claiming to be law enforcement at your door. Share concerns with your security team immediately so they can coordinate with local authorities. Be wary of follow-up scams where criminals pose as support services to steal more data. Ensure your personal information is not publicly accessible and consider adjusting your home security measures during the incident.
What to do and how to stay safe: Semperis
- Review personal social media settings to limit the exposure of home addresses and daily routines.
- Inform family members and close contacts about the situation so they can report suspicious approaches.
- Document any threatening communications or deliveries for law enforcement and internal security records.
- Coordinate with your organisation's incident response team to understand the specific threats levelled against you.
Step-by-step guide: Endpoint Detection and Response for Small Teams
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is triple extortion in ransomware attacks?
Triple extortion involves encrypting data, threatening to leak stolen data, and adding psychological or physical threats against staff to force payment.
How common are physical threats in ransomware campaigns?
According to the Semperis report, forty per cent of attacks involved psychological or physical threats against staff, an increase from the previous year.
What are the most common intimidation tactics used?
Sending threatening messages or packages is the most common, followed by threats against family and friends, and threats of physical intrusion into homes or offices.
