Ransomware attacks are increasingly accompanied by threats against employees and their families, according to Semperis research covering 1,200 organisations that had experienced ransomware incidents during the preceding year. The study also records extensive reported attacker use of artificial intelligence and repeated targeting of corporate identity systems.
The company’s 2026 Ransomware Risk Report, announced on 14 October, surveyed victims across nine countries, including Britain. It does not represent a random sample of all businesses and cannot establish the proportion of organisations generally likely to suffer ransomware attacks or associated intimidation.
Semperis found that 40% of the attacks described by respondents involved psychological or physical threats against staff. In 53% of cases involving such threats, victims reported that attackers had followed through in some form. Those accounts are survey responses rather than independently adjudicated evidence of each alleged criminal act.
The company’s original newsroom release states that 24% of victims or their family members reported being subjected to swatting, a tactic involving false emergency reports intended to prompt a police response. The measure applies to the study’s affected population and should not be described as a rate among all employees or businesses.
The report also recorded that 25% of victims sought psychological or medical treatment because of attacks, while 24% said they or their families hired personal security. These findings illustrate how extortion can place pressure on individuals outside the organisation’s technical systems.
Criminal ransomware activity has evolved beyond encrypting files and demanding payment for a decryption key. Attackers may steal information, threaten publication or identify employees and relatives in an attempt to increase pressure on decision-makers. Businesses responding to such incidents need procedures for staff welfare and communications as well as computer recovery.
The original Semperis announcement reports that threat actors used AI in 84% of the attacks experienced by surveyed victims worldwide. The supplied UK breakdown gives a figure of 88%. Both are attributed perceptions from the research rather than technical proof that AI was decisive in each incident.
Artificial intelligence may be used to prepare messages, process stolen information or assist elements of an intrusion, while conventional methods such as stolen credentials and software vulnerabilities remain important. The report does not justify treating every attack as an autonomous AI operation.
Identity infrastructure was targeted or exploited in 87% of the surveyed attacks, according to Semperis. Systems such as Active Directory, Microsoft Entra ID and Okta are central to authentication and permissions, so their compromise can obstruct recovery even when ordinary business files have been backed up.
Only about half of respondents said they maintained dedicated identity backups, and fewer than half reported automated identity recovery. A company may restore documents yet remain unable to trust its accounts, access rules or administrative services until identity systems have been rebuilt and verified.
Nearly 70% of victims said they had faced multiple attacks, while 31% reported making multiple payments. Payment does not guarantee that attackers will delete stolen material, restore access or avoid returning. Recovery planning therefore needs to address persistent access and the reliability of restored systems.
The method used to classify AI involvement is particularly important because attackers can use such tools at different stages of an incident. Assistance in drafting a message is not equivalent to autonomous penetration of a network or direct exploitation of a security weakness. Detailed incident investigation would be required to attribute technical actions, rather than relying solely on a respondent’s impression of the attack.
Recovery plans also need to address communication when core authentication systems are unavailable. Employees may be unable to access ordinary email or collaboration tools just when management must provide instructions and welfare information. Independent channels, trusted contact procedures and rehearsed authority arrangements can reduce confusion during an incident without eliminating the criminal risks described by respondents.
Semperis develops identity security and recovery products and has a commercial interest in these findings. Even with that qualification, the reported threats show why ransomware response is not solely a technology task. Legal, communications, HR, security and executive teams may all need defined roles when digital extortion creates risk to staff or their families.
You must be logged in to post a comment.