Ransomware gangs have spent years threatening data. Now a growing share of them are threatening people. A new industry report published October 14, 2026 found that 40% of ransomware attacks studied involved psychological or physical threats against staff, a shift that security researchers say marks a distinct and dangerous turn in how extortion crews pressure victims into paying.
The Semperis 2026 Ransomware Risk Report, based on a global survey of 1,200 organizations that had suffered a ransomware attack during the first half of 2026, lays out numbers that read less like a cybersecurity briefing and more like a crime blotter. Stalking. Threats of abduction. Intimidating letters and packages sent to employees’ homes. The report’s authors frame this as the next stage of an extortion business that has run out of easy digital leverage and started reaching into the physical world.
What the Semperis Report Actually Found
The headline figure is stark: 40% of attacks in the surveyed population involved some form of psychological or physical threat directed at staff. Breaking that down further, 23% of respondents reported psychological intimidation and 17% reported outright physical threats. These are not abstract warnings baked into a ransom note template. They are targeted, personal, and in many cases delivered through channels designed to feel inescapable.
Among victims who said they experienced this kind of intimidation, 57% received threatening texts, letters, or packages. More than a third, 37%, said the threats extended to friends or family members of employees, not just the employees themselves. Nearly one in five respondents, 19%, reported threats involving physical intrusion into a home or workplace. The numbers get darker from there: 17% reported abduction threats, 13% reported threats of bodily harm, and 6% described being stalked.
The report also breaks down the coercive tactics gangs lean on most. Data erasure, destruction, or publication topped the list at 56%, a reminder that double extortion (stealing data before encrypting it, then threatening to leak it) is still the workhorse tactic. Blackmail or extortion tied to personal or reputational exposure came in at 41%, and system lockouts or sabotage followed at 40%. Physical and psychological threats, in other words, are layered on top of an already aggressive playbook rather than replacing it.
| Threat Type | Share of Affected Respondents |
|---|---|
| Psychological or physical threats (overall) | 40% |
| Psychological intimidation | 23% |
| Physical threats | 17% |
| Threatening texts, letters, or packages | 57% |
| Threats against friends or family | 37% |
| Physical intrusion threats | 19% |
| Abduction threats | 17% |
| Bodily harm threats | 13% |
| Stalking | 6% |
Reporting on the study has been picked up widely, including by the HIPAA Journal, which covers the healthcare sector’s particular exposure to this trend given how often hospitals and clinics sit at the center of ransomware campaigns. Infosecurity Magazine and the BBC also covered the findings, framing them as evidence that extortion has moved well past the “pay us or lose your files” era.
Why Attackers Are Escalating Now
The logic behind this shift is not mysterious. For years, the threat behind a ransomware attack was contained to data: encrypt it, steal it, threaten to leak it. Companies responded by building better backups, faster recovery pipelines, and incident response playbooks that reduced how much leverage a locked file system actually provided. As recovery got faster and insurers got stricter about payment terms, the purely digital threat lost some of its teeth.
Gangs responded by looking for forms of pressure that technology cannot neutralize. A company can restore encrypted servers overnight. It cannot restore an employee’s sense of safety after a family member receives a threatening letter at home. That asymmetry is exactly what the new wave of tactics exploits, and it helps explain why reports described in outlets like GBHackers keep surfacing the same pattern: digital extortion plateaus, personal extortion fills the gap.
Shattered.io has tracked this pattern building for more than a year. Our coverage of the 49% surge in active ransomware groups through 2025 showed an increasingly crowded criminal marketplace, and more groups competing for the same pool of victims tends to produce more aggressive tactics as each gang tries to stand out and close deals faster.
The Follow-Through Problem
What separates this report from prior warnings about ransomware rhetoric is the emphasis on consequences that extend past the initial threat. Victims in the survey did not just describe receiving scary messages. A meaningful share described concrete fallout: people seeking psychological or medical treatment after an intimidation campaign, people hiring personal security, and reported cases of employees or their families having their information published or weaponized against them.
That matters for how security teams and executives should think about risk modeling. A threat that is purely theatrical can be absorbed with the right communications plan. A threat with a real-world follow-through rate changes the entire calculus around whether to engage with attackers, how to involve law enforcement, and how fast to loop in physical security and HR, not just the incident response team.
Historical Context: How Extortion Tactics Evolved
Ransomware extortion has gone through a fairly clear progression over the past several years. The earliest wave relied purely on encryption: lock the files, demand payment for the decryption key, done. Backups eventually blunted that approach, so gangs added a second layer around 2020 to 2022: steal data before encrypting it, then threaten to publish or sell it if the ransom went unpaid. This “double extortion” model is still the most common tactic in the 2026 report, cited by 56% of respondents.
By 2023 and 2024, extortion had become more targeted and multi-channel. Attackers began naming specific executives, customers, and partners in leak-site countdowns, turning reputational pressure into a public spectacle rather than a private negotiation. Identity infrastructure, meaning the login systems and privileged accounts that control access across a company, became a prized target because compromising it enabled deeper and more durable access than encryption alone ever could.
Personal-dimension tactics, including doxxing and harassment aimed at individual staff rather than the company as a whole, became more visible through 2024 and 2025. The 2026 Semperis findings describe the next step in that same line: threats that move from a person’s data and reputation to their physical safety and that of their family. Shattered.io’s own tracking of the broader numbers, including the finding that ransomware data theft surged 275% even as ransom payment rates declined, supports the idea that attackers are compensating for falling payment compliance by escalating pressure elsewhere.
Expert Perspective on the Shift
Security researchers who track ransomware negotiations have been warning about this trajectory for a while, even before the 2026 figures made it quantifiable. Brett Callow, a ransomware analyst at Emsisoft, has cautioned that the financial stakes involved can push some operators toward real violence. He said “my concern is that this will spill over into real-world violence very soon,” adding that “when there are millions to be had, they might do something bad to an executive of a company that was refusing to pay, or a member of their family.”
Chet Wisniewski, director and global field CTO at Sophos, has pointed specifically to family members as the most effective pressure point gangs have found. He described it this way: “the one that stands out to me that’s the most dangerous, scary, the one that’s most likely to succeed, is going after and doxxing family members of the executives.”
Jeff Wichman, director of breach preparedness and response at Semperis, has described how much personal detail attackers now gather before making contact. He said “the attackers know where the executives live, they know where their families are, they know where their kids go to school.” Wichman also explained the psychology behind why vague threats can be more effective than specific ones: “if I tell you, ‘I’m going to attack your kids at school,’ you increase the security at school, whereas if I just say ‘I’m gonna attack your family,’ when we go to the grocery store, when we go to the movie theater, when we go to school, it makes it a little bit scarier.”
Who Is Most at Risk
The Semperis report does not name every group responsible for every tactic in its survey, and the available coverage is careful not to attribute specific statistics to specific gangs. What is clear is that the wider ransomware ecosystem, now numbering well into the hundreds of active groups and affiliates, has normalized this kind of pressure as a standard escalation path rather than a rare outlier used by one or two notorious crews.
Healthcare, legal services, and financial firms tend to show up disproportionately in this kind of reporting, largely because employees in those sectors sit on sensitive personal data and because the organizations themselves have deep pockets and strong incentives to avoid public scrutiny. Shattered.io covered a related example in Luna Moth’s campaign against more than 100 law firms, which relied heavily on social engineering and reputational pressure rather than pure technical exploitation, a tactic that sits one step away from the personal-threat escalation described in the new report.
Market and Business Impact
The business implications go beyond the immediate safety concerns. Cyber insurance underwriters are increasingly factoring reputational and personal-threat exposure into policy pricing, not just technical risk. Executive protection services, once a niche line item reserved for high-profile CEOs, are becoming a more common budget request from security teams who have read reports like this one and want to get ahead of it rather than scramble after an incident.
There is also a talent and retention angle that boards are starting to take seriously. Employees in finance, HR, and IT roles who negotiate directly with attackers, or whose names and families end up targeted during an incident, face a kind of occupational hazard that was largely theoretical five years ago. Companies that fail to account for this in their incident response planning risk losing the very staff they need most during a crisis. Zscaler’s recent research, covered in Shattered.io’s report on generative AI’s role in ransomware payouts, found average payouts still running into the hundreds of thousands of dollars, which underscores how much financial incentive remains behind these campaigns even as payment rates fall overall.
Competitive Landscape: How the Threat Model Compares Across Sectors
Not every industry faces this escalation equally. Organizations with highly centralized, well-resourced security operations tend to report lower rates of successful intrusion but do not appear to be immune to personal-threat tactics once a breach occurs. Smaller organizations and those in sectors with thinner security budgets, meanwhile, show up more often in follow-through statistics, likely because they have fewer resources to manage a crisis involving both a technical incident and a personal safety concern simultaneously.
| Response Factor | Large Enterprise | Small/Mid-Size Organization |
|---|---|---|
| Dedicated incident response team | Common | Rare, often outsourced |
| Executive protection resources | Increasingly budgeted | Largely unavailable |
| Law enforcement coordination speed | Faster, established contacts | Slower, first-time contact |
| Employee support (psychological/medical) | Formal EAP programs | Ad hoc or absent |
| Public disclosure posture | Legal and PR teams manage messaging | Limited crisis communications capacity |
This disparity is one reason the ransomware economics keep tilting toward volume over precision for smaller targets, while larger organizations face fewer successful breaches but more sophisticated personal-pressure campaigns when a breach does occur. That split tracks with the broader trend Shattered.io has reported on, where attackers increasingly tailor extortion tactics to the specific pressure points of each victim rather than running a single playbook across every target.
What Security Teams Can Actually Do About It
Technical defenses still matter, but they are no longer sufficient on their own. Security leaders reviewing the Semperis findings should be building cross-functional response plans that bring HR, legal, physical security, and communications teams into the same room as the incident response team, ideally before an attack happens rather than during one.
- Establish a direct line to law enforcement before an incident, not during one, since personal threats may cross into criminal territory that falls outside a typical cyber incident response scope.
- Train employees, especially those in finance, HR, and executive roles, on what personal-threat intimidation looks like so they recognize it early and report it rather than handling it alone.
- Audit how much personal information about staff and their families is publicly discoverable, since attackers are clearly using open-source reconnaissance to build these threats.
- Build psychological and medical support into incident response budgets, not as an afterthought but as a planned line item.
- Coordinate with cyber insurance providers early to understand what personal-threat scenarios are and are not covered under existing policies.
Predictions: Where This Trend Goes Next
Based on the trajectory visible across 2023 through 2026, a few outcomes look likely over the next year or two.
- Personal-threat tactics will keep spreading beyond the groups currently associated with them. Once a tactic proves effective at accelerating payment, less sophisticated affiliates tend to copy it quickly.
- Regulators and law enforcement will face growing pressure to treat ransomware-linked personal threats as a distinct category of crime rather than folding them into general cybercrime statutes, given how different the investigative and victim-support needs are.
- Executive protection and family-safety services will become a standard line item in enterprise security budgets, not just for Fortune 500 companies but for mid-size firms that handle sensitive data.
- Insurance underwriting will increasingly separate personal-threat exposure from standard cyber risk, likely raising premiums for sectors like healthcare and legal services that show up most often in these reports.
- Public reporting on follow-through rates, not just threat volume, will become the more closely watched metric in future industry surveys, since a threat that is acted on changes the risk calculation far more than one that is merely issued.
How This Fits the Broader Ransomware Picture
It is worth situating this report inside the larger ransomware numbers Shattered.io has tracked through the year. Attack volume has kept climbing even as payment compliance falls, a combination that on its face seems contradictory until you factor in tactics like the ones described in the Semperis findings. If fewer victims pay simply because they were encrypted, attackers need a second lever, and personal intimidation is clearly one of the levers filling that gap.
The pattern also lines up with other incidents covered this year, including the arrest of a ransomware negotiator tied to his own hack, which exposed how blurry the line between victim-side responders and the criminal ecosystem can become when the financial incentives are large enough. The more personal and high-stakes extortion becomes, the more that line is likely to blur further, not less.
The Legal and Ethical Gray Zone
Personal-threat tactics also raise harder legal questions than pure data extortion. A company that pays a ransom to stop a data leak is making a business decision, however distasteful. A company whose employees face credible threats of abduction or bodily harm is dealing with something closer to a hostage situation, and the decision-making calculus, including whether and how to involve law enforcement, changes substantially. Organizations that have not updated their incident response playbooks to distinguish between these two scenarios are operating with a significant blind spot.
There is also a disclosure question. Data breach notification laws in most jurisdictions were written with stolen records in mind, not threats against individuals. Legal teams are increasingly having to interpret existing breach notification frameworks to figure out whether and how a personal-threat incident needs to be reported, a gap that regulators have not yet fully closed.
FAQ: Ransomware Groups and Real-World Threats
What did the Semperis 2026 Ransomware Risk Report find?
The report, published October 14, 2026, found that 40% of ransomware attacks among 1,200 surveyed organizations involved psychological or physical threats against staff, including threats against family members, physical intrusion, abduction, and stalking.
How many organizations were surveyed?
The study covered 1,200 organizations globally that had experienced a ransomware attack, with data collected during the first half of 2026.
What percentage of attacks involved threats against family members?
37% of respondents reported that attackers made threats against employees’ friends or family members, not just the employees themselves.
Are specific ransomware groups named as responsible for these tactics?
The available reporting on the Semperis study does not attribute specific physical-threat statistics to individual named gangs. The findings describe a broader pattern across the ransomware ecosystem rather than singling out particular groups for each tactic.
Why are ransomware gangs shifting toward personal threats?
As backups and recovery processes have improved, pure data-encryption threats have lost some leverage. Security researchers say attackers are compensating by targeting pressure points that technology cannot fix, namely the physical safety and privacy of employees and their families.
What should companies do to prepare for this kind of threat?
Security leaders are advised to build cross-functional incident response plans involving HR, legal, physical security, and law enforcement contacts established in advance, along with employee training to recognize and report personal-intimidation attempts early.
Does paying a ransom reduce the risk of personal threats?
The report does not establish that payment eliminates personal-threat risk. Given that 53% of victims in related coverage said attackers followed through on at least some threats, paying does not appear to be a reliable guarantee against further intimidation.
How does this compare to prior years?
Earlier Semperis research already documented doxxing and swatting as emerging tactics, with 37% of attacks in that earlier period involving threats against friends or family. The 2026 figures represent an escalation and broader measurement of a trend that was already visible rather than an entirely new phenomenon.