Summary
- Semperis surveyed 1,200 organisations affected by ransomware in the previous 12 months.
- Respondents reported extensive use of AI by attackers, repeated victimisation, and psychological or physical intimidation.
- Identity systems were frequently targeted, while dedicated identity recovery capabilities remained incomplete across surveyed organisations.
Ransomware attacks are increasingly being accompanied by threats against employees and their families, according to new research that also identifies extensive reported use of artificial intelligence and significant weaknesses in organisations’ ability to recover compromised identity systems.
The 2026 Ransomware Risk Report from Semperis, published on 14 October, examines the experiences of 1,200 organisations affected by ransomware during the preceding 12 months.
The study includes respondents from the UK, France, Germany, Italy, Spain, the United States, Canada, Australia, and Singapore.
Its findings suggest that ransomware pressure increasingly extends beyond encrypted files and threatened data disclosure to include intimidation directed at people involved in an organisation’s response.
Semperis reports that 40% of attacks experienced by respondents involved psychological or physical threats against staff, including threats of abduction or bodily harm.
The report also records accounts of attackers following through on threats, incidents involving false emergency reports to law enforcement, and employees or family members obtaining personal security or medical support.
These figures reflect responses from organisations already affected by ransomware. They are not independently verified counts of criminal incidents and should not be interpreted as representative of all organisations.
Extortion pressure extends beyond systems
Ransomware has developed from attacks primarily concerned with encrypting information into a wider form of extortion involving data theft, public disclosure threats, and pressure against organisations’ reputations and operations.
Intimidation directed at individuals adds another dimension to this process.
Semperis’s research describes threats against staff and their families as a means of increasing pressure to make a ransom payment.
The first-party report states that 24% of victims or family members were subjected to swatting, in which false emergency information is used to provoke a law enforcement response. It says 53% of respondents who reported threats said attackers followed through on them.
It reports that 25% of respondents experienced consequences serious enough to seek psychological or medical treatment, while 24% reported hiring personal security for victims or family members.
The broader finding is that the consequences of ransomware can extend beyond technology recovery into employee welfare, physical safety, and the conduct of crisis management.
Those pressures may be particularly difficult for organisations to manage because the people responsible for containing an incident can also become targets of intimidation.
Tim Beasley, Senior Incident Response Consultant at Semperis, describes the emotional consequences for cybersecurity staff, including individuals who have left their roles after serious incidents.
The research does not establish that threats of physical harm have become the dominant form of ransomware extortion. It does indicate that such threats are present in a substantial proportion of the surveyed organisations’ experiences.
AI and repeated victimisation
Semperis reports that artificial intelligence was weaponised in 84% of the attacks described by respondents, with the UK figure reaching 88%.
These are survey findings based on participants’ accounts. They do not independently establish which AI technologies attackers used, how frequently they were deployed, or whether AI was essential to the success of individual attacks.
The study also reports that nearly 70% of affected organisations experienced multiple ransomware attacks, while 31% made multiple payments to attackers.
Repeated victimisation can arise in different circumstances. A business may experience a new intrusion from an unrelated actor, a return by the original attacker, or further exploitation of weaknesses that were not fully addressed after an earlier incident.
The survey does not, on its own, establish the cause of each repeat attack.
It nevertheless raises questions about whether organisations are treating ransomware recovery as the restoration of services or as a broader process of eliminating attacker access and correcting underlying weaknesses.
Identity recovery remains a weak point
The research identifies identity infrastructure as a frequent target during ransomware incidents, including systems such as Microsoft Active Directory, Entra ID, and Okta.
Its key findings state that 87% of surveyed attacks targeted identity systems; a separate figure of nearly 75% refers to identity targeted or exploited during successful attacks and should not be treated as an equivalent measure.
These platforms manage authentication, account permissions, and access to the applications and systems on which businesses depend.
If identity infrastructure is compromised or becomes unavailable, restoring individual servers or applications may not be enough to resume operations safely.
Employees may be unable to authenticate, administrators may lack reliable access, and organisations may struggle to establish which accounts and credentials remain trustworthy.
Semperis reports that only around half of surveyed organisations maintain dedicated identity backup systems, while fewer than half automate identity system recovery.
The company’s findings also indicate that identity-specific recovery procedures are missing from many broader disaster recovery and crisis management arrangements.
Recovery capability is therefore not simply a question of preserving a copy of directory information. Organisations must be able to restore a trustworthy identity environment without reintroducing compromised credentials or configurations.
For businesses operating across hybrid cloud environments, identity restoration can involve dependencies between on-premises directories, cloud authentication services, privileged accounts, and third-party applications.
The report’s findings place those dependencies alongside the human consequences of extortion. Employees may be managing the restoration of critical systems while facing pressure from criminals seeking to influence the organisation’s payment decision.
Semperis’s survey provides evidence about the experiences of ransomware victims across nine countries. Its results do not establish the prevalence of those tactics among businesses that have never experienced an attack, but they identify gaps between the pressures reported by victims and the recovery capabilities available to them.
