A quarter of ransomware campaigns now include psychological or physical threats aimed directly at company staff, the Semperis 2026 Ransomware Risk Report found on October 14.
Triple extortion: adding physical threats to encryption and data leaks
The report describes a widening set of tactics used by ransomware operators: the classic demand for a decryption key, the threat to publish stolen data, and an additional layer of intimidation aimed at employees. Semperis calls this combination "triple extortion" — the physical or psychological threats are applied on top of the usual cyber extortion levers to increase pressure on victims to pay.
How attackers are threatening staff: messages, family, and intrusions
Semperis documents the mechanics of those threats. Among campaigns that use intimidation, 57% involved sending threatening messages, letters or packages to staff at the victim organization. Attackers threatened family members and friends of employees in 37% of those incidents, and threatened physical intrusions into offices or homes in 19% of cases. Those tactics are explicitly designed to raise the perceived cost of resisting ransom demands.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDoxxing, swatting and measurable human harm
The intimidation has produced concrete harms. Of organizations affected by ransomware gangs employing these tactics, 25% said their staff had been doxxed and 23% reported that employees had been swatted as part of the extortion campaign. Companies reported needing to provide psychological treatment to staff, and in some cases the target of doxxing or swatting moved home. The report links these outcomes directly to the expanding repertoire of extortion methods.
Numbers and expert framing from Semperis
Semperis surveyed 1,200 IT and security professionals across North America, the UK, Europe and the Asia‑Pacific for the 2026 Ransomware Risk Report. The research also notes that, overall, 40% of attacks involved psychological or physical threats against staff — a rise on the previous year. Semperis CEO Mickey Bresman summarized the shift bluntly: “Ransomware has proven to be a great cash‑generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm.”
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams should expect extortion playbooks that combine data encryption with targeted attacks on employee safety; the report suggests this is increasingly common and likely to shape post‑incident responses.
- Policymakers and regulators will see this as a change in the threat model: psychological and physical threats are now part of ransomware campaigns, and that shift has implications for guidance and legal protections for staff affected by doxxing and swatting.
- Affected enterprises and procurement leaders must weigh the non‑technical costs of an incident — employee trauma, relocation, and the need for psychological support — alongside restoration and recovery expenses when deciding how to respond to an attack.
Chris Inglis, a Semperis Strategic Advisor, framed the calculus plainly: “An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in. Holding you at physical risk is the latest phenomenon because we've covered most of the other risks.”
The Semperis findings mark an escalation in the human stakes of ransomware. Technical defenses and backup strategies remain essential, but the report underscores a painful reality: when adversaries broaden their tactics to include threats against people, organizations face decisions that extend well beyond code and infrastructure.
Read the original Semperis report coverage at Infosecurity Magazine.
