Ransomware Gangs Are Making It Personal: More Than a Third of Attacks Now Include Threats Against Staff
A new survey of ransomware victims finds 37% of attacks involved psychological or physical threats against employees and their families. Here is what attackers are doing and how layered defenses reduce the pressure.
Here Is How Layered Defenses Help When Extortion Moves From Your Servers to Your People
Ransomware used to be about locked files and stolen data. Increasingly, it is also about frightening the people who decide whether to pay. Incident responders now describe executives receiving photos of their children’s schools, threatening packages at home and fake emergency calls that send armed police to a victim’s door.
The figures here come from Semperis’ annual ransomware risk report, as covered in Jessica Lyons’ article for The Register. The study surveyed 1,200 organizations that had suffered ransomware, during the first half of 2026.
What the report found
- 37% of ransomware attacks involved psychological or physical threats against staff: psychological intimidation in 23% and physical threats in 17%.
- A quarter of victims experienced doxxing, where personal details such as home addresses and phone numbers are posted online.
- 25% needed psychological or medical treatment after an attack, 24% hired personal security, and 23% experienced swatting calls.
- More than half (53%) said attackers carried out threats in the past year. Reported threats included texts, letters or packages (57%), threats against family or friends (37%) and physical intrusion (19%).
- 69% were targeted more than once in 12 months, and 31% paid more than once.
Semperis consultant Tim Beasley, who once received an unexplained parcel of Russian souvenirs while investigating a state-backed group, says groups such as Scattered Spider, ShinyHunters and Lapsus$ use these tactics. His advice: “Don’t be afraid to get the FBI involved, sooner rather than later. And don’t pay them.”
Why one control isn’t enough
Backups protect your files, but they do nothing for an executive whose home address has just been posted online. Personal threats aim at the moment of decision, so the defense has to cover the network, the people and the plan.
What this means for your company: the layers, in order
- Shrink what attackers can find. Review what is public about leaders and key staff, from home addresses on property and business records to family details on social media. Data-removal services and tighter privacy settings help.
- Make the first break-in harder. Phishing-resistant sign-in, prompt patching of internet-facing systems and help-desk identity checks block the entry points groups like Scattered Spider favor.
- Keep backups the attacker can’t reach. Offline or immutable backups, tested regularly, take away the leverage of encrypted systems.
- Plan for threats to people, not just systems. Your incident response plan should say who contacts law enforcement, how threatened employees and families are supported, and when to bring in physical security.
- Decide your payment stance in advance. A decision made calmly beforehand, with legal counsel and your insurer, is harder to break under pressure. The survey shows paying often invites another attack.
- Prepare staff for swatting and harassment. Tell employees what to do if they get a threatening message or package, and consider letting local police know ahead of time if your leaders may be targeted.
Need help building a ransomware plan that protects your people as well as your data? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
