Ransomware Groups Escalate to Physical Threats Against Employees and Families, Semperis Survey Finds
A Semperis survey, covered by HIPAA Journal, finds ransomware groups increasingly threatening victims' employees and their families as the share of victims paying ransoms falls from 78% in 2024 to 69% in 2025 and 59% in 2026. Of the attacks surveyed, 37% involved threats against friends or family of staff, and 41% of respondents said they had been targets of physical or psychological intimidation. Attackers contact individuals by text, email or phone and claim to know where they live, work and where their children attend school. Semperis says that in 53% of cases the attackers followed through on their threats. The report urges organizations to build responses to these personal threats into their ransomware resilience plans.
Detalhes técnicos
- Most common tactics: data erasure, destruction or publication (56%), blackmail/extortion (41%), and system lockouts or sabotage (40%).
- 23% of actors used psychological intimidation, 17% made physical threats and 10% threatened legal exposure.
- Among individuals who received personal threats: 57% received threatening texts, letters or packages, 37% received threats about friends and family, 19% were threatened with physical intrusion, 17% with abduction, 13% with bodily harm and 6% with stalking.
- About 25% of victims reported doxxing and 23% experienced swatting.
- About a quarter of targeted individuals needed medical or mental health care, and 14% had to change jobs, offices or homes.
Remediação
- Add procedures to ransomware resilience plans for threats against individuals outside the organization.
- Build relationships with law enforcement in advance as part of the crisis management plan.
- Strengthen identity resilience and prepare for identity system breaches.
- Rehearse incident response against realistic scenarios, including tabletop exercises involving all team members in the ransomware response.
Linha do tempo
-
Ransomware Groups Escalate to Physical Threats Against Employees and Families, Semperis Survey Finds
ler a análise desta fonte ocultar
A Semperis survey, covered by HIPAA Journal, finds ransomware groups increasingly threatening victims' employees and their families as the share of victims paying ransoms falls from 78% in 2024 to 69% in 2025 and 59% in 2026. Of the attacks surveyed, 37% involved threats against friends or family of staff, and 41% of respondents said they had been targets of physical or psychological intimidation. Attackers contact individuals by text, email or phone and claim to know where they live, work and where their children attend school. Semperis says that in 53% of cases the attackers followed through on their threats. The report urges organizations to build responses to these personal threats into their ransomware resilience plans.
Technical Details
- Most common tactics: data erasure, destruction or publication (56%), blackmail/extortion (41%), and system lockouts or sabotage (40%).
- 23% of actors used psychological intimidation, 17% made physical threats and 10% threatened legal exposure.
- Among individuals who received personal threats: 57% received threatening texts, letters or packages, 37% received threats about friends and family, 19% were threatened with physical intrusion, 17% with abduction, 13% with bodily harm and 6% with stalking.
- About 25% of victims reported doxxing and 23% experienced swatting.
- About a quarter of targeted individuals needed medical or mental health care, and 14% had to change jobs, offices or homes.
Remediation
- Add procedures to ransomware resilience plans for threats against individuals outside the organization.
- Build relationships with law enforcement in advance as part of the crisis management plan.
- Strengthen identity resilience and prepare for identity system breaches.
- Rehearse incident response against realistic scenarios, including tabletop exercises involving all team members in the ransomware response.