Ransomware Gangs Now Targeting Staff Safety to Force Payment

Ransomware gangs are increasingly threatening the physical safety of senior staff, according to the Semperis 2026 Ransomware Risk Report, published on October 14. The report found that 40% of attacks involved psychological or physical threats against staff at the targeted company, an increase on the previous year. A quarter of ransomware campaigns now include such threats. These come on top of the demand for a decryption key and the threat of leaking stolen data, an approach known as triple extortion.

The tactics vary. The most common are threatening messages, letters or packages sent to staff (57%), followed by threats against employees' family and friends (37%) and threats of physical intrusion into offices or homes (19%). Among organisations hit by these tactics, 25% said staff had been doxxed (had personal details published) and 23% said employees had been swatted (targeted with a false emergency report). Consequences have included companies funding psychological treatment for affected staff, and in some cases a victim moving home.

The pressure is designed to work even when a business can restore its systems from backups. Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor, said attackers aim to make the cost of resisting greater than the cost of giving in, and that holding people at physical risk is the latest step because most other risks have already been covered.