Ransomware Extortion Is Moving Off-Screen and Into the Real World
Ransomware gangs are no longer limiting their pressure tactics to encrypted files and leak-site countdowns. According to Semperis's newly released 2026 Ransomware Risk Report, a growing share of ransomware operators are now threatening — and in some cases allegedly carrying out — physical intimidation against victim organizations' employees, executives, and their families.
The survey, which polled roughly 1,200 organizations globally, found that two out of every five respondents who suffered a ransomware attack reported facing intimidation or threats as part of the extortion, and more than half of those said the attackers followed through on at least some of what they threatened.
By the Numbers
| Tactic | Share of Affected Organizations |
|---|---|
| Threats to employees' family and friends | 37% |
| Psychological intimidation (general) | 23% |
| Doxxing (publishing names, addresses, phone numbers) | 25% |
| Physical intrusion into facilities | 19% |
| Physical threats | 17% |
| Abduction threats | 17% |
| Bodily harm threats | 13% |
| Swatting of victims or family members | 23% |
| Stalking | 6% |
| Sought psychological or medical treatment afterward | 25% |
Why Attackers Are Escalating
Chris Inglis, the first U.S. National Cyber Director and now a Semperis strategic advisor, framed the shift as a straightforward cost-benefit calculation on the attacker's side: an extortionist's only goal is to make resisting more painful than paying. "Holding you at physical risk is the latest phenomenon because we've covered most of the other risks," Inglis said, pointing to the fact that encryption alone, and even data leak threats, have become less reliably effective as victims improve backups and incident response.
Separately, cybersecurity firm Tanium has reported ransomware groups gathering employees' home addresses and family details, with some cases involving criminals showing up at employees' residences disguised as delivery personnel or officials to deliver threats in person.
An Important Caveat
Despite the alarming figures, independent verification remains thin. Dark Reading's review of the report noted it could not independently confirm a documented case of ransomware-linked violence, and a Europol release Semperis cited as supporting evidence on "violence-as-a-service" did not itself tie that violence to ransomware extortion specifically. The underlying data relies heavily on self-reporting by the victim organizations surveyed, rather than forensically confirmed incidents.
One concrete anecdote did surface: a Semperis employee reportedly received a threatening package during a ransom negotiation, illustrating how personal these campaigns have become even for the incident responders brought in to help.
What It Means for Defenders
- Incident response plans should account for physical risk. Organizations negotiating with or responding to ransomware actors should loop in physical security and, where warranted, law enforcement — not just IT and legal.
- Executives and IT/security staff are explicit targets. Personal information exposure (home addresses, family details) is now part of the ransomware attack surface, not just corporate data.
- Treat self-reported intimidation claims with appropriate skepticism while still taking the operational risk seriously — the psychological pressure is real even where physical follow-through is unverified.
- Doxxing and swatting readiness matter. Security awareness training and personal OPSEC guidance for leadership and incident responders should reflect this expanded threat model.