Ransomware Gangs Escalate Extortion With Physical Violence Threats, Doxxing and Swatting Against Staff, Semperis Reports
The Semperis 2026 Ransomware Risk Report, published on October 14, warns that ransomware operators are increasingly threatening the physical safety of CISOs, executives and other senior staff at victim organizations to force payment. The report says a quarter of ransomware campaigns now involve psychological or physical threats against employees, while another figure in the report puts the share of attacks with such threats at 40%, up from the previous year. This layer comes on top of encryption and data-leak threats, a model the report calls triple extortion. It is designed to pressure victims who could restore from backups to pay anyway. The findings are based on a survey of 1,200 IT and security professionals across North America, the UK, Europe and Asia-Pacific.
Detalhes técnicos
- Most common intimidation methods: threatening messages, letters or packages sent to staff (57%), threats against employees' family and friends (37%), and threats of physical intrusion into offices or homes (19%).
- Among organizations hit by these tactics, 25% said staff were doxxed and 23% said employees were swatted.
- Reported consequences include psychological treatment for affected staff and, in some cases, victims relocating their homes.
- The article does not name specific ransomware groups, malware families or initial access vectors.
Remediação
The article does not provide remediation guidance. It implies that backup-based recovery alone does not remove the pressure to pay when staff safety is threatened.
Linha do tempo
-
Ransomware Gangs Escalate Extortion With Physical Violence Threats, Doxxing and Swatting Against Staff, Semperis Reports
ler a análise desta fonte ocultar
The Semperis 2026 Ransomware Risk Report, published on October 14, warns that ransomware operators are increasingly threatening the physical safety of CISOs, executives and other senior staff at victim organizations to force payment. The report says a quarter of ransomware campaigns now involve psychological or physical threats against employees, while another figure in the report puts the share of attacks with such threats at 40%, up from the previous year. This layer comes on top of encryption and data-leak threats, a model the report calls triple extortion. It is designed to pressure victims who could restore from backups to pay anyway. The findings are based on a survey of 1,200 IT and security professionals across North America, the UK, Europe and Asia-Pacific.
Technical Details
- Most common intimidation methods: threatening messages, letters or packages sent to staff (57%), threats against employees' family and friends (37%), and threats of physical intrusion into offices or homes (19%).
- Among organizations hit by these tactics, 25% said staff were doxxed and 23% said employees were swatted.
- Reported consequences include psychological treatment for affected staff and, in some cases, victims relocating their homes.
- The article does not name specific ransomware groups, malware families or initial access vectors.
Remediation
The article does not provide remediation guidance. It implies that backup-based recovery alone does not remove the pressure to pay when staff safety is threatened.