Ransomware attackers escalate personal threats against victims and families

Semperis report finds 37% of attacks involve psychological or physical intimidation

By LineZotpaper

Published14 October 2026

Read Time2 min

Ransomware gangs are increasingly turning to real-world harm and psychological trauma to force victims into paying extortion demands, according to a new report from cybersecurity firm Semperis. The study, based on 1,200 post-ransomware organizations surveyed worldwide, found that more than a third of attacks now involve threats against employees, their families, or personal property, with tactics including doxxing, swatting, and even sending packages to investigators' homes.

The shift toward personal intimidation marks a significant escalation in the ransomware landscape, where attackers have moved beyond encrypting data and demanding payment, according to Tim Beasley, a senior incident response consultant at Semperis who previously served as lead investigator for Microsoft’s Detection and Response Team (DART). Beasley recalled investigating a cyberattack linked to Russia’s Midnight Blizzard when a package containing nesting dolls and other regional gifts appeared at his doorstep. "Just little souvenirs and gift basket stuff from that area of the world. We-know-where-you-are kind of stuff. It's a real eye-opener when you get that type of thing," he told The Register.

The Semperis annual ransomware risk report, conducted over the first half of 2026, found that 37 percent of ransomware attacks involved psychological or physical threats against staff. Of those, 23 percent involved psychological intimidation, 17 percent physical threats. A quarter of victims reported being doxxed, and another quarter sought psychological or medical treatment after an attack. Twenty-four percent hired personal security teams, while 23 percent experienced swatting calls.

In a stark finding, 53 percent of respondents said ransomware attackers carried through on threats in the past year. The types of threats reported included threatening texts, letters, or packages (57 percent), threats against family or friends (37 percent), physical intrusion (19 percent), abduction (17 percent), bodily harm (13 percent), and stalking (6 percent). Beasley identified groups like Scattered Spider, ShinyHunters, and Lapsus$ as employing such tactics. ShinyHunters denied targeting humans but acknowledged "there are times in the work we do sometimes we have to push the corporate to the absolute limit."

Beasley urged defenders and executives to "stand your ground" and not buckle under pressure.

Analysis

Why This Matters

Ransomware is moving from digital disruption to threats of physical harm, directly affecting employees' safety and mental health.
The rise of personal intimidation may push more victims to pay ransoms out of fear, emboldening attackers and escalating the crisis.
Companies now face pressure to invest in personal security for employees including security teams, training, and psychological support.

Background

Ransomware has evolved from encrypting files to extortion via data leaks, a tactic known as double extortion. In recent years, some groups have added harassment and real-world threats. The Semperis report documents a systematic shift where psychological and physical harm is becoming a routine tool, reflecting a broader trend observed by Europol in its crackdown on networks like The Com that blend hacking with real-life violence.

Key Perspectives

Victim organizations and employees: They face unprecedented safety risks, with attackers leveraging social media reconnaissance to target families. The cost of attacks now extends beyond ransom payments to include personal security and medical treatment. Ransomware groups (ShinyHunters, etc.): Some claim they do not attack people directly but acknowledge pushing corporations to extremes. The line between digital extortion and physical threat appears blurred for many groups. Incident responders: They advise standing firm, but the growing threat of harm makes that advice harder to follow when the pressure turns personal.

What to Watch

Whether more ransomware groups adopt physical threats as a standard tactic, as suggested by the Semperis data.
Law enforcement responses to swatting and doxxing in context of extortion.
How insurance and compliance frameworks adapt to require personal security measures.

Sources

Ransomware gets personal: 'We-know-where-you-are kind of stuff' — www.theregister.com - Articles