Ransomware operators are extending their extortion tactics beyond corporate networks by threatening employees’ families and using artificial intelligence to enhance their attacks, according to the Semperis 2026 Ransomware Risk Report.
Among the surveyed victims, 37% reported threats against their family members or friends, while 84% experienced attacks that involved AI in some form.
The findings are based on a Censuswide survey of 1,200 IT and security professionals across nine countries and eight industry sectors during the first half of 2026.
Importantly, the research focused only on organizations that experienced successful ransomware attacks that disrupted business operations, rather than the broader enterprise population.
Ransomware Gangs Threaten Employee
Traditional pressure tactics remain prevalent: 56% of respondents reported threats involving data erasure, destruction, or release. Other tactics included blackmail, extortion, or public shaming (41%) and system lockouts or operational sabotage (40%). However, attackers are increasingly supplementing these methods with intimidation aimed directly at individuals.
Reported personal threats included threatening texts, letters, or packages (57% of responses), threats of physical intrusion (19%), abduction (17%), and bodily harm (13%). These figures reflect reported threats and not confirmed incidents of kidnapping or physical injury.
These threats extended into victims’ personal lives. A quarter reported experiencing doxxing that affected employees or their families. In contrast, 23% reported swatting: fabricated emergency reports intended to dispatch law enforcement to a target’s location. Additionally, 25% sought medical or psychological treatment, and 14% faced relocations of jobs, offices, or homes.
Separately, 53% of respondents said that attackers acted on threats during the previous year. However, the report does not clarify whether this percentage specifically represents fulfilled physical threats.
Semperis reported that 40% of respondents experienced AI-based attacks, while 44% experienced attacks that exploited their own AI agents or systems.
This distinction matters because it points to both attacker-operated AI and compromised enterprise AI, rather than suggesting each affected organization faced autonomous ransomware.
Tomer Bar, Semperis’ security research executive, warned that large language models could help attackers test malicious code and reduce errors in encryption implementation.
Chris Inglis, former US National Cyber Director, also noted that AI increases the speed, scale, and sophistication of attacks. These assessments accompany survey findings but do not attribute specific technical details to individual campaigns.
Defensive AI produced mixed results. While 49% of respondents reported successfully using AI for detection or response, 23% indicated that their AI tools failed to detect or respond effectively.
Identity infrastructure was targeted or exploited in 87% of surveyed cases. Respondents identified the following systems as primary targets: Active Directory (51%), Microsoft Entra ID (48%), and Okta (27%), underscoring attackers’ focus on access and privilege management.
However, only 50% of organizations maintained dedicated identity backups, and only 42% had automated identity recovery solutions in place. Semperis cautioned that insufficient recovery preparation could leave organizations vulnerable to persistent attacker access and complicate restoration to a secure state.
Repeat attacks increased pressure on organizations, with 69% reporting multiple successful attacks and 59% having paid ransom at least once. Nearly a quarter of those who paid said they couldn’t remove the attackers.
The report recommends restricting AI agents’ access to identity infrastructure, documenting identity recovery procedures, and conducting training for realistic crisis scenarios.
Response plans should also include alternative communication methods, clearly defined responsibilities, and advance contacts with law enforcement for threats against employees and their families, treating personal safety as a crucial aspect of cyber resilience.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
