Semperis survey puts threats against ransomware victims' staff at 40% of attacks
Semperis reports that 40% of ransomware attacks in its survey of 1,200 security professionals involved psychological or physical threats against staff. Infosecurity Magazine says the threats could still push a victim to pay when backups would let it restore.
The Watch · Security desk
Ranking of intimidation forms in the Semperis survey: threatening messages, letters or packages sent to staff 57%, threats against family and friends of employees 37%, threats of physical intrusion into offices or homes 19%.
Most common forms of intimidation, per the Semperis survey
| Rank | Item | Value | Claim |
|---|---|---|---|
| 1 | Threatening messages to staff | 57% | 4 |
| 2 | Threats to family and friends | 37% | 4 |
| 3 | Threats of physical intrusion | 19% | 4 |
What happened
- Threatening messages, letters or packages sent to staff were the most common form of intimidation at 57%, ahead of threats to family and friends at 37% and physical intrusion at 19%.
- Among organizations hit by these tactics, 25% said staff had been doxxed and 23% said employees had been swatted.
- scworld.com, citing Dark Reading, reports that over half of respondents said attackers followed through on the threats.
- Semperis published the 2026 Ransomware Risk Report on October 14.
Why it matters
- Who has to decide decision A recovery plan that ends at a clean restore leaves a doxxed or swatted employee with no owner. On the survey's 40%, we think the plan should name who handles staff safety.
- What it costs cost Employers carry the bill for psychological treatment of targeted staff, and in some cases the targeted employee has moved home.
- What doesn't add up contradiction Infosecurity Magazine gives both 40% and a quarter for how many attacks carry these threats. scworld.com's two in five matches the 40%.
Next story · Security · Oct 8
Silent Ransom Group sent recruited 'agents' into US law firm offices, leaked chats showConfirmed2 publishers
The 40% is self-reported. scworld.com, relaying Dark Reading, says the report relies on self-reporting and lacks independent corroboration [8]. Infosecurity Magazine calls the figure an increase on the previous year [2], but its article does not include the earlier figure, so the size of the rise cannot be checked. Respondents sat in North America, the UK, Europe and Asia-Pacific [5].
Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor, said: "An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in." [16] He added: "Holding you at physical risk is the latest phenomenon because we've covered most of the other risks." [17]
Evidence outside the survey is thinner. scworld.com reports that the FBI has seen a substantial increase in threats of violence in cyberattacks generally [10], and that direct links between ransomware and physical violence are not definitively proven [11]. By region, Italy showed particularly high rates of abduction and bodily harm threats [6].
The one group named in that coverage, Silent Ransom Group, was documented posing as IT technicians to gain physical access to corporate offices [12]. That is a different tactic from the threats the survey counts.
What to watch
- Whether Semperis or another vendor publishes the prior-year figure, so the reported increase can be measured.
- Whether the FBI releases counts of violence threats in ransomware cases that can be set against the self-reported survey data.
- Whether incident-response firms report doxxing and swatting rates from their own cases.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Semperis 2026 Ransomware Risk Report was published on October 14.
- [2]
According to the Semperis report, 40% of attacks involved psychological or physical threats against staff at the targeted company, an increase compared with the previous year.
- [3]
Semperis survey data indicates that two in five organizations faced intimidation and threats related to ransomware attacks.
- [4]
The most common forms of intimidation were threatening messages, letters or packages sent to staff (57%), threats against family and friends of employees (37%) and threats of physical intrusions into offices or homes (19%).
- [5]
The research was based on a survey of 1,200 IT and security professionals across North America, the UK, Europe and the Asia-Pacific region.
- [6]
Figures varied by region, with Italy showing particularly high rates of abduction and bodily harm threats.
- [7]
Of organizations affected by ransomware gangs using these tactics, 25% said staff had been doxxed and 23% said employees had been swatted.
- [8]
The report relies on self-reporting and lacks independent corroboration.
- [9]
Consequences of the doxxing and swatting have ranged from companies having to support employees through psychological treatment to, in some cases, the victim moving home.
- [10]
The FBI also reported a substantial increase in threats of violence in cyberattacks generally.
- [11]
Direct links between ransomware and physical violence are not yet definitively proven.
- [12]
The Silent Ransom Group was documented posing as IT technicians to gain physical access to corporate offices.
- [13]
The same Infosecurity Magazine article also says a quarter of ransomware campaigns now involve psychological or physical threats to staff at the targeted company.
- [14]
Over half of respondents reported that attackers followed through on the threats.
- [15]
Even if an organization is confident it could restore its network from backups, the threat of physical or emotional violence against its staff could encourage the payment of a ransom anyway.
- [16]
Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor, said: "An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in."
- [17]
Inglis also said: "Holding you at physical risk is the latest phenomenon because we've covered most of the other risks."
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comRansomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments
1 article · October 16, 2026
- scworld.comRansomware actors reportedly escalating to physical threats and violence
1 article · October 14, 2026
Topics and entities
Topics
- Ransomware
- Extortion tactics
- Security industry surveys
Entities
- Silent Ransom Group
- Federal Bureau of Investigation