The leading identity protection firm Semperis has released its 2026 Ransomware Risk Report exposing how cybercriminals have adopted a new approach to pressure victims into paying ransom. Rather than limiting actions to data encryption or theft, attackers now direct psychological and physical threats towards executives, employees and their families. The study, which surveyed only organizations hit by ransomware in the past year across the US, UK, France, Germany, Italy, Spain, Singapore, Canada and Australia, reveals some alarming figures. Seventeen per cent of IT and security professionals reported experiencing physical threats while 23 per cent faced psychological intimidation. More than half (53 per cent) of those threatened said the attackers carried out their threats.
Specific forms of intimidation included threatening texts, letters or packages (57 per cent), threats against family members or friends (37 per cent), physical intrusion (19 per cent), abduction threats (17 per cent) and risks of bodily harm (13 per cent). Around a quarter of affected individuals reported that employees or their families were doxed (25 per cent), swatted (23 per cent), needed medical or psychological treatment (25 per cent) or hired personal security (24 per cent). Some victims were forced to change jobs, relocate offices or move house.
Overall, 40 per cent of attacks involved psychological or physical threats against staff. Chris Inglis, the first US National Cyber Director and a Semperis strategic adviser, explained the shift in approach. “An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in,” he said. “Holding you at physical risk is the latest phenomenon because we've covered most of the other risks.”
The report highlights how artificial intelligence now plays a central role in the ransomware economy. Threat actors weaponized AI in 84 per cent of attacks globally, rising to 88 per cent in the UK. This technology supports more sophisticated operations, including repeat attacks on the same victims. Nearly 70 per cent of organizations faced multiple incidents, with 31 per cent making multiple ransom payments.
Identity infrastructure remains a primary target. Some 87 per cent of attacks focused on systems such as Active Directory, Okta and Entra ID . Despite this, only about half of companies maintain dedicated identity backups, automated recovery solutions or specific crisis response procedures for identity systems.
Inglis emphasized the central importance of identity security. “Identity is the coin of the realm. If an attacker can steal an identity, they’re off to the races,” he said. He noted that insider threats often involve external actors abusing legitimate privileges or processes running beyond control, making identity the core vulnerability in every case.
The findings show that many organizations remain unprepared for the speed and complexity of modern ransomware campaigns. While attackers continue to evolve their methods, moving from simple encryption to double extortion and now to direct personal threats, defenses have not kept pace.
Semperis chief executive, Mickey Bresman, observed that criminals adapt quickly when earlier tactics meet resistance. Initial waves focused on encryption before shifting to data theft and exposure threats once backup systems improved. Personal intimidation represents the latest effort to increase pressure on victims. Semperis senior incident response consultant, Tim Beasley, described the human cost. IT and cybersecurity teams already operate under considerable stress, and these attacks intensify the pressure to the breaking point for some leaders.
The report calls for improved identity protection, faster recovery capabilities and greater awareness of personal safety risks to counter the changing ransomware landscape. Organizations are urged to treat identity systems as critical assets requiring dedicated safeguards.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
• Reporting: https://www. redskyalliance. org/
• Website: https://www. redskyalliance. com/
• LinkedIn: https://www. linkedin. com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5504229295967742989
Comments