Cybersecurity company Semperis said 37% of respondents who experienced intimidation reported threats against relatives or friends, while 84% of surveyed ransomware incidents involved attackers exploiting artificial intelligence. The findings underline how criminals are combining technical intrusions with personal pressure to extract payments.
The 2026 Ransomware Risk Report surveyed 1,200 information technology and security professionals at organisations affected by ransomware during the preceding 12 months. Respondents came from nine countries across eight industry sectors. Its findings describe the experiences of victims rather than the prevalence of ransomware across all businesses.
Psychological or physical threats against employees featured in more than a third of attacks, according to the study. Respondents described threatening messages, letters and packages, alongside harassment directed at people outside the targeted organisation. The survey also recorded incidents involving stalking, unauthorised physical entry and threats of bodily harm.
Among respondents reporting intimidation, 53% said attackers had carried out threats. The study did not establish that every reported threat resulted in physical injury, and its figures are based on participants’ accounts rather than independently documented criminal cases.
The consequences extended beyond disrupted networks. About one quarter of affected respondents reported seeking psychological or medical treatment, while 24% said victims or their families had employed personal security. Another 23% reported swatting, a practice involving false emergency calls intended to bring police to an individual’s address.
Chris Inglis, a former United States national cyber director and strategic adviser to Semperis, said criminals were seeking to make resistance to ransom demands more costly than compliance. He identified threats to personal safety as another means of increasing pressure on organisations already dealing with compromised systems.
Artificial intelligence was another prominent feature of the findings. Attackers reportedly used the technology in 84% of incidents, although the survey did not establish that AI independently caused those breaches. Separate findings indicated that criminals sometimes exploited AI tools already deployed inside victim organisations, adding another potential route for misuse.
Such activity can include assistance with malicious communications and other stages of an intrusion. The findings do not mean that every attack was autonomous or that human operators had ceased directing ransomware campaigns. The distinction matters as organisations assess the actual capabilities behind criminal claims about AI.
Identity infrastructure remained a major weakness. Semperis said 87% of attacks targeted identity systems, including Microsoft Active Directory, Entra ID and Okta, which organisations use to manage accounts, authentication and access privileges. Compromising these services can make it harder to isolate intruders and restore normal operations.
Preparedness did not match the exposure identified by the survey. Only about half of participating organisations maintained dedicated identity backups, while fewer than half had automated recovery capabilities. The company also found that 60% of disaster recovery or crisis response plans lacked procedures specifically covering identity system restoration.
Those gaps are significant because restoring files and servers does not necessarily re-establish trustworthy access controls. An organisation may recover business applications while remaining unable to verify that compromised credentials, administrator privileges or authentication services have been secured.
Repeated attacks added to the pressure. Nearly 70% of surveyed victims said they had been targeted more than once within a year, and 31% reported making multiple ransom payments. These figures describe the surveyed victim population and should not be interpreted as rates for organisations generally.
Semperis chief executive Mickey Bresman said extortion methods had evolved from encrypting information to combining encryption with data theft and threats of disclosure. Pressure against individuals represented another tactic designed to overcome victims’ ability to refuse payment.
Tim Beasley, a senior incident response consultant at Semperis, said the strain could also affect cybersecurity staff responsible for managing incidents. He described security leaders leaving their roles after attacks and employees facing blame from management over breaches.
The report highlighted the difficulty of preparing for simultaneous technical disruption and threats against individuals. Responses to such incidents can involve security teams, senior management and personnel responsible for employee welfare and safety.
The survey covered organisations in the United States, Britain, France, Germany, Italy, Spain, Singapore, Canada and Australia. Its results were released on 14 October, providing a snapshot of reported victim experiences across those markets rather than a verified count of attacks worldwide.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
