Australian cybersecurity executives are increasingly being targeted with threats to their physical safety during ransomware incidents, according to Semperis’ 2026 Ransomware Risk Report.
The report found 41% of attacks involving Australian organisations included psychological intimidation or threats to physical safety. In 53% of those cases, victims said attackers followed through on the threats.
Semperis said the most common reported tactics included hostile packages or letters sent to executives’ home or office addresses (70%), physical intrusions at the home or office (47%), and intimidation of family and friends (41%).
Beyond immediate operational disruption, the report points to broader consequences for staff wellbeing and workforce retention. Semperis reported that 51% of victims or their families hired personal security following an attack, 47% sought psychological or medical treatment, and 35% said they or family members were “swatted”. A further 26% said they were forced to move to a different job, office or home address.
“IT and cybersecurity staff are already dealing with high levels of stress,” said Tim Beasley, Semperis Senior Incident Response Consultant. “A ransomware attack takes that to a whole new level. I have seen CISOs say, ‘I’m out. I’m done. I can’t do this. It isn’t worth it.’ I’ve seen people walk out the door because leadership thought they mismanaged something that caused the breach to occur. It all takes a mental toll.”
Semperis’ findings also suggest repeat victimisation remains common. The report said 84% of ransomware victims were targeted multiple times, while 57% made multiple payments to attackers. It also stated that, in the last 12 months, 79% of Australian organisations surveyed paid a ransom.
The report argues identity systems remain a primary target during ransomware events. Semperis reported that 98% of successful ransomware attacks targeted identity systems such as Active Directory, Entra ID and Okta, while 63% of surveyed organisations maintained dedicated identity backups and 59% had automated identity recovery solutions.
Gerry Sillars, Semperis Vice President for Asia Pacific and Japan, pointed to the Australian Signals Directorate’s guidance on identity security, arguing that preparation should address both system recovery and employee safety. “Our Australian findings show the human impact can be just as serious as the technical one,” Sillars said.
You can read the full report here.
