Ransomware Gets Personal: Australian Security Leaders Face Threats to Their Physical Safety

Ransomware is no longer just a technical problem. Semperis' 2026 Ransomware Risk Report found that 41% of attacks involving Australian organisations included psychological intimidation or threats to physical safety. In 53% of those cases, victims said attackers followed through. The most common tactics were hostile packages or letters sent to homes or offices (70%), physical intrusions (47%) and intimidation of family and friends (41%).

The personal toll was significant. Semperis reported that 51% of victims or their families hired personal security, 47% sought psychological or medical treatment, and 35% said they or family members were "swatted". A further 26% were forced to change job, office or home address. Semperis consultant Tim Beasley said he has seen CISOs walk away from the profession, and others leave because leadership believed they had mismanaged something that led to the breach.

The report also points to repeat victimisation: 84% of victims were targeted more than once, and 57% made multiple payments. In the last 12 months, 79% of surveyed Australian organisations paid a ransom. Semperis says 98% of successful attacks targeted identity systems such as Active Directory, Entra ID and Okta, yet only 63% of organisations kept dedicated identity backups and 59% had automated identity recovery. Semperis' Gerry Sillars said preparation should cover both system recovery and employee safety.