Ransomware gangs add physical threats to encryption attacks

According to the Semperis 2026 Ransomware Risk Report published Oct. 14, 2026, a quarter of ransomware campaigns involve psychological or physical threats to staff at targeted companies, based on a survey of 1,200 IT and security professionals across North America, the UK, Europe and Asia‑Pacific.

40% of ransomware attacks involved psychological or physical threats against staff, marking an increase versus the previous year. The data come from a survey of 1,200 IT and security professionals spanning North America, the United Kingdom, Europe and the Asia‑Pacific region.

Common intimidation tactics include threatening messages, letters or packages in 57% of cases. Threats directed at family or friends of employees occur in 37% of incidents. Threats of physical intrusion into offices or homes are reported in 19% of cases.

Among organizations affected by these tactics, 25% reported that staff had experienced doxxing (their personal information published online). Additionally, 23% said employees had experienced swatting (falsely reporting a serious crime to prompt a police raid).

Consequences of such threats include companies providing psychological treatment for affected staff. Victims have relocated their homes to escape further intimidation. The gangs aim to make resisting their demands more costly than paying them.

Ransomware has proven to be a great cash‑generating activity for criminal syndicates. These groups show no hesitation about inflicting both cyber and physical harm on victims. Ransomware gangs turn to real‑world threats against executives and their families to gain leverage as firms boost their cyber resilience. A Semperis‑commissioned survey identifies this approach.

Semperis’s third annual ransomware risk report, published Oct. 14, 2026, found that 59% of victimized organizations paid a ransom in 2026, compared with 69% in 2025 and 78% in 2024.

The ransom payments are reducing – they're still incredibly high, by the way – but the ransom payments are reducing.

Simon Hodgkinson, BnkInfoSecurity

The gangs describe their shift as moving from a data‑centric crime to a people‑centric crime again. They identify the pressure point as fear, specifically human fear.

Initially, ransomware gangs could profit from simply encrypting data because of low entry barriers and low risk. As companies adopted resilient backups, the gangs moved to double extortion, encrypting data while threatening to leak decrypted data publicly. When detection and mitigation improved and victims became reluctant to pay, the gangs added threats of personal violence to their repertoire.

Victims may suddenly receive a picture of their child’s school or an image of their license plate on their phone.

Beasley observed that real‑world threats such as doxxing or swatting are more common in Europe and the Middle East than in the Americas. He also noted that some individuals in the Americas are willing to carry out the threats, which can lead to actual violence, although such acts remain rare.

Beasley said he received a ‘goodie bag’ of Russian handicrafts at home, which he interpreted as a threat conveying the message ‘We know exactly where you live’.

The concept of ‘violence‑as‑a‑service’ (where cyber threat actors hire local criminals to commit assaults) enables cyber threat actors to hire local criminals worldwide to commit assaults. This means organizations cannot dismiss threats of real‑world violence as idle rhetoric.

Matt Polak, CEO of VanishID, said that involving executives’ families in threats shifts negotiation dynamics from the boardroom to the kitchen table. Some gangs use personal threats to gain technical access, for example by infecting an executive’s phone to lure them into plugging a malicious USB at work. Ian Gray of Flashpoint said that physical attacks represent a higher escalation than remote threats, and we should not consider them equally common.

Recent developments show cybercriminals resorting to physical intimidation and threats of violence to force ransom payments. Ransomware attacks have disrupted essential services, especially hospitals, by encrypting patient records and interrupting medical procedures. In some cases, these disruptions have contributed to patient deaths. Such incidents show that cyberattacks can directly affect human lives and public safety.

Semperis said a significant share of 2025 ransomware attacks included physical‑threat extortion, with over half intimidating staff. These incidents are increasingly common in Western nations, particularly the United States, the United Kingdom, Canada and parts of the Middle East. Tanium said ransomware gangs collect employee personal data, including home addresses, and sometimes visit homes in disguise to threaten staff. This shift marks a move from traditional cyber extortion to real‑world harassment and intimidation by organized criminal networks with global reach.

State‑sponsored groups tied to Russia, China, Iran, or North Korea are accused of attacking critical infrastructure, risking injuries or fatalities and blurring the line between cybercrime and warfare. Paying ransoms may encourage further criminal activity, prompting cybercriminals to adopt more extreme tactics. Cryptocurrency facilitates anonymous payments, which increases the profitability of ransomware operations.

Governments and firms should boost digital defenses, raise employee awareness, and maintain reliable backups. They should also develop laws specifically aimed at countering cyber extortion. Society must recognize that cybercrime is now a major threat to human safety, economic stability and global security, not merely a technological issue.