Semperis Report: Ransom Threats Target Employee Families and Homes
A new survey reveals that over a third of ransomware victims face threats against their families, forcing some to seek medical care or relocate.
Key points
- Ransomware groups threatened family members at 37% of surveyed organizations.
- One in four targets required medical or psychological treatment due to threats.
- % of organizations suffered multiple successful ransomware attacks in one year.
Ransomware operators are increasingly extending their intimidation tactics beyond corporate networks to target the personal lives of employees. According to Semperis’ 2026 Ransomware Risk Report, attackers threatened family members or friends at 37% of organizations included in the survey. The study gathered data from 1,200 IT and security professionals at companies that had experienced at least one successful ransomware attack, highlighting a shift toward personal coercion.
The risk
Criminals use these personal threats to increase pressure on staff and employers to meet ransom demands. Respondents described receiving threatening messages, being stalked, and facing threats of physical harm. These tactics are designed to exploit the emotional vulnerability of employees, making the financial decision to pay more difficult for leadership. The psychological toll on incident response teams is significant, with some security leaders reporting they left their roles due to the stress.
Who is exposed
The impact of these attacks extends to the physical safety of employees and their households. The Semperis survey found that 23% of respondents reported swatting incidents, where false emergency reports trigger police responses at personal locations. Doxxing, the non-consensual exposure of personal information online, was also cited as a consequence. Some employees had to obtain security protection or change their jobs, offices, and homes following an attack, illustrating the severe personal disruption caused by these cyber incidents.
Cost and compliance
The human cost of these attacks is substantial, with a quarter of respondents stating that employees or their families needed medical or psychological treatment. Mickey Bresman, Semperis CEO, noted that ransomware remains a lucrative activity for syndicates willing to inflict both cyber and physical harm. Tim Beasley, a Senior Incident Response Consultant at Semperis, observed that the mental toll can cause CISOs to resign, citing the overwhelming stress of managing breaches that lead to such personal consequences for staff.
What to watch
Organizations should anticipate that attackers may leverage personal information to bypass corporate defenses. The pressure to restore operations quickly can lead to incomplete remediation, leaving backdoors or compromised accounts active. Teams must verify that all attacker access is removed before restoring services, as 69% of surveyed organizations faced multiple successful attacks within a single year, suggesting persistent access issues.
Signals worth monitoring
Teams usually detect personal extortion attempts through unusual communication patterns involving employee accounts. Security operations should check for sudden spikes in data exfiltration from HR or personnel files, which often precede doxxing. Monitor for unauthorized access to employee directory services or contact lists. Containment moves typically involve isolating affected user accounts and preserving log evidence for law enforcement. Establish clear protocols for reporting threats against personal safety to ensure rapid response and support for impacted staff members.
What to do and how to stay safe: Semperis
- Document response roles that include procedures for threats against employees’ family members and friends outside the workplace.
- Establish relationships with local law enforcement agencies before an incident occurs to facilitate faster reporting of swatting or physical threats.
- Verify that all malware, backdoors, and compromised accounts are removed from systems before restoring operations to prevent re-infection.
- Monitor for signs of doxxing or personal data exposure in public forums and social media during an active incident response.
Step-by-step guide: Ransomware Backups: Definition, Purpose, and Recovery Strategy
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of organizations faced threats against employee families?
According to the Semperis 2026 Ransomware Risk Report, attackers threatened family members or friends at 37% of the surveyed organizations.
Did any employees require medical care due to these threats?
Yes, one in four respondents reported that employees or their family members needed medical or psychological treatment because of the ransomware threats.
How common are repeat ransomware attacks?
The survey found that 69% of the organizations experienced multiple successful ransomware attacks within the previous year.
