Key facts
- Ransomware groups increasingly use doxxing and family threats to pressure victims into paying.
- Semperis 2026 survey of 1,200 IT/security pros across nine countries found 84% of victims saw AI‑involved attacks and 87% saw identity‑infrastructure targeting.
- The same survey reported 37% of respondents said employees’ friends or family had been threatened, while 41% cited physical or psychological intimidation.
- About 25% said employees or family were doxxed (identities exposed online without consent) and 23% reported swatting that drew law enforcement to a victim’s location.
Ransomware groups increasingly use doxxing and family threats to pressure victims into paying, according to a Semperis survey of 1,200 IT/security professionals across nine countries in 2026.
The same Semperis survey found that 84% of victims observed AI‑involved attacks and 87% saw identity‑infrastructure targeting. Also, 37% of respondents said employees’ friends or family had been threatened, while 41% cited physical or psychological intimidation.
About 25% reported that employees or family members were doxxed, meaning their identities were exposed online without consent, and 23% said swatting incidents (false reports that draw law enforcement to a location) brought law enforcement to a victim’s location. Approximately 25% noted that employees or relatives needed medical or psychological care because of the intimidation, and 24% said they hired extra security personnel.
Fourteen percent of those surveyed were forced to change jobs, relocate, or move homes due to the threats. Semperis also found that 44% of surveyed organizations experienced attacks that manipulated their own AI agents or systems.
Threats that target corporate employees beyond corporate borders are an unusual new phenomenon
Chris Inglis, CSO Online
The Zscaler ThreatLabz 2026 report measured 896.2 terabytes of data exfiltrated, a rise of more than 275% compared with the previous year. Blockchain‑tracked ransomware payments totaled $328 million, with the average payment increasing 5.3% to $431,995. Manager‑level or higher employees made up 62% of ransomware victims, showing that attackers focus on privileged roles.
Dragos counted 1,140 ransomware incidents against industrial organizations in Q2 2026, up 12% from Q1, with manufacturing accounting for 65% of the total. In the June 10 2026 Mackay Sugar attack, ransomware halted milling at two Queensland mills. The Gentlemen ransomware group later listed Mackay Sugar on its leak site, although there was no evidence of industrial control system compromise. Qilin, Akira and The Gentlemen were the top industrial ransomware groups in Q2 2026, with claim counts of 140, 129 and 125 respectively.
Several groups contacted employees over Microsoft Teams while posing as internal IT support
Lexie Mooney and Abdulrahman H. Alamri, Help Net Security
Proofpoint’s global survey revealed that 65% of ransomware‑hit organizations said AI increased attack effectiveness, mainly by crafting more convincing phishing and credential‑theft campaigns. In Proofpoint’s analysis, 40% of victims said the initial lure appeared legitimate because AI‑generated emails lacked typical suspicious cues.
AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to ransomware
Ryan Kalember, Infosecurity Magazine
Acronis notes that AI acts as an operational force multiplier, accelerating reconnaissance, credential abuse and data theft without creating wholly new ransomware techniques. Microsoft logs about 38 million identity‑risk detections daily, underscoring identity compromise as a core ransomware enabler. Recommended mitigations include maintaining an AI tool inventory and enforcing least‑privilege access. Further measures are monitoring AI activity with SIEM/XDR (security information and event management/extended detection and response), using immutable backups, and requiring human approval for high‑risk AI actions.
Join the discussion