Firms face backlash as AI ransomware gangs coerce staff via family threats
Survey data reveals attackers are escalating extortion by targeting employees’ relatives with physical and psychological intimidation tactics.
Key points
- % of surveyed ransomware victims experienced attacks involving artificial intelligence technologies.
- % of respondents reported that employees’ friends or family members were directly threatened by attackers.
- % of respondents stated that employees or their relatives required medical or psychological treatment after these incidents.
Ransomware operators are increasingly extending their extortion tactics beyond corporate networks to target the personal lives of employees and their families, according to a report by CSO Online. The Semperis 2026 Ransomware Risk Report highlights a shift toward using artificial intelligence and physical intimidation to pressure organisations into paying ransoms. This strategy moves beyond traditional file encryption, aiming to create personal distress that distracts staff and forces management decisions.
How it unfolded
- Traditional ransomware relied on encrypting files and demanding payment for decryption keys, but attackers have adopted new methods as organisations improve recovery.
- Attackers adopted double extortion tactics, combining data theft with threats to leak or sell stolen information to increase pressure on victims.
- The report notes attackers are adding personal intimidation to their tactics, using AI tools to exploit organisational systems and threaten individuals directly.
Who is affected
The survey covered 1,200 IT and security professionals across nine countries and eight sectors, including finance, healthcare, manufacturing and government. According to CSO Online, 87% of surveyed ransomware victims reported attacks targeting identity infrastructure, while 41% of respondents reported physical or psychological intimidation. Approximately 25% said employees or family members were doxed, and 23% reported swatting incidents involving fabricated emergency reports. Some victims were forced to change jobs, relocate offices or move homes, with around 24% hiring additional security measures.
The fix
No specific software patch or technical fix has been confirmed for these social engineering and intimidation tactics. The report indicates that organisations are responding by improving backup and recovery systems to mitigate the impact of encryption and data theft. However, these technical controls do not address the personal threats made against staff. Companies must recognise that extortion is moving beyond digital boundaries, requiring new approaches to protect employee safety and privacy alongside traditional cybersecurity defences.
What analysts watch for
Teams usually examine communication logs for unusual contact attempts targeting staff outside of work hours. Analysts check whether attackers have accessed identity management systems to gather personal details about employees. They monitor for signs of doxing or fabricated emergency reports that could indicate swatting. Security teams review access patterns to identity infrastructure, as this is a common target for gathering leverage. They also assess if artificial intelligence tools within the organisation have been misused to generate threatening content or bypass security controls.
Background: Social engineering
Use this checklist to harden your organisation against social engineering. It covers verification procedures, email hygiene and physical security. Each item includes a reason for inclusion. Implement these controls to reduce the risk of credential theft and unauthorised access through human manipulation.
Read the full guide: Social Engineering Prevention Checklist: Stop Manipulation Before Access
What to do and how to stay safe: Semperis
- Review identity infrastructure access logs to detect unauthorised queries for employee personal data.
- Establish clear protocols for handling threats received by staff, including immediate escalation to security teams.
- Ensure backup systems are isolated and tested regularly to reduce reliance on paying ransoms for data recovery.
- Educate employees on recognising and reporting intimidation attempts, including doxing or swatting, without delay.
Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of ransomware victims experienced AI-related attacks?
According to the Semperis 2026 Ransomware Risk Report, 84% of surveyed ransomware victims experienced attacks involving artificial intelligence.
How many respondents reported threats against family members?
The survey found that 37% of respondents said employees’ friends or family members had been threatened by attackers.
What sectors were included in the survey?
The survey covered eight sectors including finance, healthcare, manufacturing, critical infrastructure and government across nine countries.
