Ransomware · Threat Intelligence
Ransomware Gangs Now Threaten Physical Harm to Pressure Victims
A new report finds ransomware gangs are increasingly threatening physical violence against company staff and their families to force ransom payments, adding a new layer of risk for victims.
Ross Grant3 min read
The short version
Ransomware attackers are now threatening not just company data, but also the safety of employees and their families. A new report says these threats include messages, doxxing, and even swatting. This is meant to scare companies into paying up, even if they could recover their data. The report is based on a survey of IT and security professionals.
By the numbers
- 40%of ransomware attacks now involve psychological or physical threatsInfosecurity Magazine
- 25%of affected organisations said staff were doxxed by attackersInfosecurity Magazine
- 23%of affected organisations reported swatting incidentsInfosecurity Magazine
- 1,200IT and security professionals surveyed for the reportInfosecurity Magazine
What happened?
A new report says ransomware gangs are increasingly threatening physical violence against company staff and their families to force ransom payments. The Semperis 2026 Ransomware Risk Report found that 40% of attacks now include psychological or physical threats, with tactics ranging from threatening messages to doxxing and swatting. These findings are based on a survey of 1,200 IT and security professionals and have been reported by Infosecurity Magazine and BankInfoSecurity.
Ransomware Tactics Are Getting More Aggressive
Ransomware gangs have started using real-world threats to pressure companies into paying up. According to a new report from Semperis, covered by Infosecurity Magazine (opens in a new tab) and BankInfoSecurity (opens in a new tab), attackers are not just threatening to leak stolen data or keep systems locked. They are now targeting company staff, including executives and their families, with threats of physical violence.
What the Report Found
The Semperis 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals across North America, the UK, Europe and Asia-Pacific. It found that a quarter of ransomware campaigns now involve psychological or physical threats to staff. In total, 40% of attacks included some form of intimidation against employees, up from the previous year.
The most common tactics include sending threatening messages, letters or packages to staff (57%), threatening family and friends of employees (37%), and even threats of physical intrusion into offices or homes (19%). These threats are in addition to the usual ransom demands for decryption keys and the threat to leak stolen data.
Triple Extortion: More Than Just Data
This new approach is called triple extortion. Traditionally, ransomware attackers would encrypt a company’s files and demand payment for the decryption key. Then, they began threatening to leak stolen data if the ransom was not paid (double extortion). Now, by adding threats of physical harm, attackers are raising the stakes even further.
Chris Inglis, former U.S. National Cyber Director and a Semperis advisor, explained: “An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in.”
Real-World Impact on Victims
The report highlights the real consequences for people targeted by these tactics. Of the organisations affected, 25% said staff had been doxxed (where personal information is published online), and 23% reported employees had been swatted (where false emergency calls are made to send police to someone’s home). Some victims needed psychological support, and in some cases, people moved home to escape the threat.
This shift in tactics is causing significant emotional trauma for staff, and the stress can affect the wider business. Mickey Bresman, CEO of Semperis, said: “Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm.”
What Organisations Can Do
As companies get better at technical defences and restoring from backups, attackers are looking for new ways to force payments. Security teams should be aware of these evolving tactics and have plans to support staff who may be targeted. This includes clear reporting channels for threats, support for affected employees, and coordination with law enforcement if necessary.
While the report shows a worrying trend, it also highlights the importance of not just technical security, but also looking after the people behind the business.
What Is Not Yet Clear
These findings come from a survey and have been reported by secondary sources. There is no direct confirmation from law enforcement or named victim organisations. The scale of actual physical violence, as opposed to threats, is not detailed in the sources.
Claimed vs confirmed
- Confirmed
Ransomware gangs are increasingly threatening physical violence against company staff and their families to extort payments.
Reported by Infosecurity Magazine and BankInfoSecurity, based on the Semperis 2026 Ransomware Risk Report.
- Confirmed
A quarter of ransomware campaigns now involve psychological or physical threats to staff.
Cited from the Semperis 2026 Ransomware Risk Report, as reported by Infosecurity Magazine.
The impact
- Money
- Ransomware payments remain high, but are reportedly decreasing as companies improve defences. However, the added threat of physical harm may pressure some victims to pay even if they could recover data. Under UK and EU law, companies could face fines if personal data is leaked.
- Reputation
- Threats against staff can cause significant reputational damage, especially if incidents become public. The emotional impact on staff can also affect morale and trust in the company.
- Customers
- Employees and their families may be at risk of harassment, doxxing, or swatting. Organisations should have clear support and reporting processes in place for staff who are targeted.
Why it matters
This trend puts ordinary employees and their families at risk, not just company data. It adds a new layer of harm and stress for victims and makes defending against ransomware more complex. Organisations need to be ready to support staff and work with law enforcement.
How does it work?
Ransomware gangs now use 'triple extortion': they encrypt company data, threaten to leak it, and also threaten physical harm to staff or their families. This can include sending threatening messages, doxxing (publishing personal information), or swatting (making false emergency calls). The aim is to increase pressure on victims to pay the ransom.
Key points
- Ransomware gangs are now threatening physical harm to staff and families.
- 40% of attacks involve psychological or physical threats, according to a new report.
- Tactics include threatening messages, doxxing, and swatting.
- This is called triple extortion: encryption, data leak threats, and physical threats.
- Organisations need plans to support staff and respond to these new risks.
Sources
BankInfoSecurity
Reference
- Frustrated Ransomware Gangs Turn to Real World Threats (opens in a new tab)
bankinfosecurity.com
- Frustrated Ransomware Gangs Turn to Real World Threats (opens in a new tab)
Infosecurity Magazine
Reference
