Ransomware criminals are increasingly using threats of physical harm against company executives and staff as a new extortion tactic, according to a report published October 14 by Semperis. The 2026 Ransomware Risk Report found that 40% of ransomware attacks now include psychological or physical intimidation directed at employees of targeted organizations, marking a rise from the prior year. The shift represents what researchers call "triple extortion," where attackers layer threats of violence on top of traditional demands for ransom payment and threats to leak stolen data.
Among ransomware campaigns specifically, one-quarter now involve psychological or physical threats against staff members at victim companies. The most prevalent form of intimidation involves sending threatening messages, letters, or packages to employees at the targeted organization, accounting for 57% of these tactics. Threats directed at family members and friends of workers represent 37% of intimidation methods, while 19% include threats of physical intrusions into offices or homes. Of organizations that experienced these tactics, 25% reported staff members being doxxed by attackers, and 23% said employees had been swatted as part of the extortion efforts. The real-world consequences have forced some victims to undergo psychological treatment, and in certain cases, individuals targeted through doxxing or swatting have relocated their homes.
The report explains that this escalation in intimidation is strategically designed to pressure victims into paying ransoms even when technical recovery is possible. "An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in," said Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor. Even organizations confident in their ability to restore networks from backups may choose to pay when faced with threats of harm to their people. Semperis CEO Mickey Bresman stated that ransomware has become a highly profitable enterprise for criminal organizations with no reluctance about causing both digital and physical damage.
The emotional toll on targeted individuals extends throughout entire organizations, creating stress that reaches far beyond the direct victims of doxxing or swatting incidents. The report suggests attackers have adopted physical threats because other risk vectors have been largely addressed by defensive measures. This additional layer of coercion fundamentally changes the calculation for victim organizations, transforming ransomware response from a technical recovery problem into a personnel safety crisis. The research drew from a survey of 1,200 IT and security professionals across North America, the UK, Europe, and the Asia-Pacific region.
As ransomware groups continue refining their pressure tactics, organizations face a dilemma where traditional cybersecurity investments may prove insufficient against threats that target human vulnerability rather than technical weaknesses. The weaponization of personal safety as leverage marks a troubling evolution that could force companies to reconsider not just their data protection strategies, but their entire approach to employee security and crisis management. Enterprises may need to balance transparency with discretion when threats against individuals emerge, avoiding both the dangers of silence and the potential escalation that public disclosure might trigger.