Organizations are reporting that employees face threats to their families, stalking, physical violence, and abduction — pressure that no longer stops at the network perimeter. Ransomware extortion has crossed a line that many defenders assumed was fixed: the boundary between a digital incident and a physical one. When a cybersecurity data breach case stops being about encrypted files and starts being about a package on an investigator's doorstep or a photo of a child's school, the calculus of an incident changes for everyone involved.
This expansion of extortion tactics sits at the center of Semperis' 2026 Ransomware Risk Report, published in October 2026. The picture it draws is uncomfortable, and it depends heavily on self-reported accounts from organizations that have already been ransomed. Reading it carefully — what it claims, what it measures, and where its limits are — is the first step toward a sane response.
The extortion playbook now has a physical dimension
Chris Inglis, the first U.S. National Cyber Director and a Semperis strategic advisor, framed the shift in plain economic terms: an attacker's goal is "to make the cost of resisting their demands greater than the cost of giving in." Having largely saturated encryption and data-leak threats, "holding you at physical risk is the latest phenomenon because we've covered most of the other risks."
That is the logic behind what Semperis' senior incident response consultant Tim Beasley calls "we-know-where-you-are kind of stuff." Beasley, who previously led Microsoft's Detection and Response Team investigations into Russia-linked Midnight Blizzard, described a gift basket of regional souvenirs arriving at his door with no note — a message rather than a present. In other cases he has seen cybercriminals send executives pictures of their children's schools, sourced through social media reconnaissance, to push them toward payment. "In our world you more and more come to expect it, which is unfortunate," he said.
The tactic is not random cruelty; it is escalation, and it follows a familiar pattern. As Mickey Bresman, Semperis' CEO, put it, early ransomware relied on encryption. When backup and recovery improved, attackers added double extortion — theft plus the threat to expose or sell data. Physical intimidation is the next rung on the same ladder.
What the 2026 Semperis ransomware report actually says
The report is a global study of 1,200 organizations that had been hit by ransomware within the previous 12 months, conducted over the first half of 2026 across the U.S., U.K., France, Germany, Italy, Spain, Singapore, Canada and Australia. The headline finding on people: roughly 40% of attacks involved psychological or physical threats against staff, a figure The Register reported as 37% in its coverage of the same dataset. Within that, respondents described psychological intimidation in the low-to-mid 20s as a percentage and outright physical threats around 17%.
More than half, 53%, of respondents said attackers actually followed through on those threats in the past year. The threats that employees reported taking include:
- Threatening texts, letters, or packages, 57%
- Threats against family or friends, 37%
- Physical intrusion, 19%
- Abduction, 17%
- Bodily harm, 13%
- Stalking, 6%
The report also documents how the broader ransomware economy is shifting. In 84% of attacks, respondents said threat actors weaponized artificial intelligence. And identity infrastructure remains the prime objective: 87% of attacks targeted identity systems such as Active Directory, Entra ID and Okta, and roughly three-quarters of successful attacks exploited them, yet only about half of organizations keep dedicated identity backups or automate identity recovery, and 60% of crisis-response plans omit identity recovery procedures entirely.
Repeat victimization is the rule, not the exception. Nearly 70% of surveyed victims were targeted multiple times within 12 months, and 31% made more than one payment.
How physical threats follow recent cybersecurity data breaches
Physical intimidation rarely appears in isolation. It tends to arrive on the back of an intrusion that already harvested credentials, identity data and personal information about the people inside a company, often with help from hired insiders, since hardening the perimeter has pushed gangs toward recruiting people who already have access. The same identity systems that attackers breach to move laterally are the systems that hold employee and executive details, the raw material for social media enrichment, doxxing and swatting. That connection is why recent cybersecurity data breaches increasingly spill out of the data center: the breach supplies the names, addresses and routines that make a credible threat to a family possible.
Groups that Beasley named in connection with these pressure tactics, Scattered Spider, ShinyHunters and Lapsus$, are better known for data theft and extortion than for violence, and at least one (ShinyHunters, in a statement to The Register) has publicly denied targeting people directly even while conceding it "pushes the corporate to the absolute limit." The point is not that every gang has gone physical, but that a recognizable set of well-known operations has made personal intimidation a credible negotiating tool, and a wider criminal underground around it normalizes it. That underground has drawn law-enforcement attention too: Europol and partners have flagged thousands of URLs tied to "The Com," a loose network whose activities span hacking, swatting and real-world violence.
The human cost: swatting, doxxing and medical treatment
The survey's most striking findings are not about systems but about people. A quarter of victims reported being doxxed, having names, home and work addresses and phone numbers published online. Roughly a quarter sought psychological or medical treatment as a result of the attack. About 24% hired personal security for themselves or their families, and 23–24% experienced swatting, in which a caller reports a fabricated bomb or active-shooter incident to trigger an armed police response at a victim's address.
Beasley also described the professional toll on the people managing the response: CISOs telling him "I'm out, I'm done" after leadership concluded they mismanaged the breach. The mental-health cost of an incident now extends from the executive suite to the household, and from the responders to their families.
The limits of survey-reported allegations
Every number above should carry the same caveat the report's framing invites. These are self-reported accounts collected from organizations under extreme stress, after the fact, by a vendor with a commercial interest in resilience tooling. A survey captures what victims believed and reported, not independently verified confirmation that each specific threat, intrusion or abduction attempt was carried out by the ransomware crew themselves. Percentages will shift depending on the question and the outlet reporting it, which is why the same dataset surfaces as both 37% and 40% in different places.
None of that makes the trend unimportant. If anything, the consistency of the signal across respondents, threats against families, follow-through in over half of cases, repeat targeting, is the reliable finding, even if any single line item is soft. Treat the report as directional evidence of a real escalation, not as a forensic record.
What defenders should do
Beasley's guidance is blunt: stand your ground, involve law enforcement early, "don't be afraid to get the FBI involved, sooner rather than later", and do not pay. The repeat-victimization data underpins the don't-pay advice: payment invites the next demand, and most victims here were attacked again anyway.
Beyond the negotiation, three practical moves follow from the data. First, plan for people, not just systems: pre-brief executive protection and family-safety awareness, and decide in advance who calls the police when a threat becomes physical. Second, treat identity as the breach's center of gravity, dedicated backups for Active Directory, Entra ID and Okta, automated recovery, and identity-specific procedures written into the crisis plan rather than bolted on after the fact. Third, harden the human surface that feeds these threats: limit publicly exposed personal details for leadership, and assume attackers will use social media reconnaissance to build the dossiers that make intimidation land.
The uncomfortable lesson of 2026 is that a ransomware case can be a physical-security incident wearing a digital costume. Protecting the network was never enough; protecting the people named in the breach is now part of the job.
Sources
- Semperis, "2026 Ransomware Risk Report" press release (Oct 14, 2026): https://www.semperis.com/ransomware-risk-report/
- The Register, "Ransomware gets personal: 'We-know-where-you-are kind of stuff'" (Oct 14, 2026): https://www.theregister.com/2026-10-14/ransomware_gets_personal_we_know_where_you_are_kind_of_stuff/5302939
- Dark Reading, "Ransomware Gangs Use Physical Threats, Stalking to Extort Victims" (cited topic source): https://www.darkreading.com/cybersecurity-analytics/ransomware-gangs-physical-threats-family-stalking
