Ransomware gangs are moving beyond locked files and stolen data. Criminals now threaten employees, executives, and their families to force companies to pay.

According to the Semperis 2026 Ransomware Risk Report, 37% of successful attacks included threats against workers’ friends or relatives.

The findings show that ransomware is no longer only a technical crisis. It can become a real safety and mental health emergency.

Ransomware Risk Key Findings (Image Source: Semperis)

Ransomware Attacks Target Employees and Their Families

Semperis surveyed 1,200 IT and security professionals from organizations hit by successful ransomware attacks during the previous 12 months. The study covered nine countries and eight sectors during the first half of 2026.

Among respondents, 57% reported threatening texts, letters, or packages. Another 19% faced threats of physical intrusion, 17% reported threats of abduction, and 13% saw threats of bodily harm.

Personal Threats Survey Statistics (Image Source: Semperis)

Attackers carried out their threats in 53% of reported cases, according to the survey. The personal impact was severe. One quarter of affected organizations said employees or family members were doxxed, meaning private details were exposed online.

About 23% reported swatting, where criminals make a false emergency call that can send armed police to a victim’s home. A further 25% said people needed medical or mental health care, while 24% hired personal security.

In 14% of cases, staff or relatives changed jobs, offices, or homes. This pressure marks the next stage of extortion. Ransomware groups first relied on file encryption. Many later added data theft and threats to leak it.

Now, criminals can study social media, breached data, public records, and company pages to identify relatives, addresses, schools, and daily routines. Such details let them build messages that feel direct and credible. The goal is simple. Make resisting the ransom seem more costly than paying it.

Artificial intelligence is also changing how ransomware operations work. The report says 84% of surveyed victims experienced attacks that used AI in some way.

This included 40% who faced AI-based attacks and 44% where criminals abused the victim’s own AI agents or systems. AI can help criminals write convincing messages, research targets, change malware, and run work at a larger scale.

However, the survey data reflects what victims reported. It does not prove exactly how AI was used in every incident. Security teams should treat the figures as a strong warning while still checking logs, malware samples, identity events, and attacker communications before linking activity to AI.

Personal pressure is growing, but identity systems remain central to ransomware. Semperis found that 87% of attacks targeted Active Directory, Entra ID, or Okta. Active Directory was targeted in 51% of cases.

Identity Infrastructure Targeting Breakdown

Yet only 50% of surveyed organizations had dedicated identity backups, and 42% had automated identity recovery tools. This gap matters because identity control can give criminals broad access, help them move across a network, and allow them to disrupt recovery.

A recent Qilin ransomware investigation showed how attackers abused Active Directory replication to collect domain credentials. Another PAYLOAD ransomware case showed criminals using Group Policy to disrupt a Windows domain without encrypting files.

Organizations should update ransomware plans to cover threats outside the network. The plan should name who contacts law enforcement, who supports targeted staff, who handles public messages, and how the company protects personal data.

Firms also need a trusted communication channel outside normal email and chat systems, since attackers may watch or disable them. Realistic exercises should include doxxing, swatting, threats to children, and contact with relatives.

Employees also need a safe, blame-free way to report suspicious contact. Companies should offer privacy checks, counseling, and clear advice for family members, while avoiding public comments that could expose victims or disrupt a criminal investigation.

Technical steps still matter. Security teams should enforce multifactor authentication, limit privileged access, segment networks, patch exposed systems, keep tested offline backups, and prepare clean recovery for identity services.

The CISA StopRansomware Guide also advises organizations to isolate affected systems, preserve evidence, keep leaders informed, and report incidents to CISA or law enforcement.

Paying does not guarantee safety, data recovery, or an end to pressure. The FBI says it does not support ransom payments because victims may receive nothing and payments support further crime.

Semperis found 59% of victims paid at least once, while 69% suffered multiple successful attacks. That pattern makes fast containment, trusted identity recovery, staff care, and early police contact just as important as restoring servers.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families appeared first on Cyber Security News.