Semperis published results from its annual global ransomware report, highlighting that AI plays a significant role in the ransomware economy. In addition, hackers are increasingly threatening physical harm against companies’ employees to extract ransom payments; in more than half the reported cases, the attackers followed through on those threats. Only organizations that were victimized by ransomware gangs in the past 12 months were included in the study.
“An attacker has one goal in mind: They want to extract something from you. And the only way they’re going to do that is to make the cost of resisting their demands greater than the cost of giving in,” said Chris Inglis, the first U.S. National Cyber Director and a Semperis Strategic Advisor. “Holding you at physical risk is the latest phenomenon because we’ve covered most of the other risks.”
The 2026 Ransomware Risk Report, found that bad actors are threatening victims with psychological intimidation in nearly 25% of all attacks in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia. In 53% of cases, the victims reported that the hackers followed through on their threats; 23% of victims or family members were swatted; 25% of victims sought psychological and medical treatment because of the ransomware attack; and 24% of victims or families hired personal security.
“IT and cybersecurity staff are already dealing with high levels of stress,” says Tim Beasley, Semperis Senior Incident Response Consultant. “A ransomware attack takes that to a whole new level. I have seen CISOs say, ‘I’m out. I’m done. I can’t do this. It isn’t worth it.’ I’ve seen people walk out the door because leadership thought they mismanaged something that caused the breach to occur. It all takes a mental toll.”
Key Findings
- AI is changing the ransomware landscape.
In 87% of attacks, threat actors weaponized artificial intelligence. - Attackers increasingly threaten victimized companies’ staff and their families.
Overall, 40% of attacks involved psychological or physical threats against staff. - Multiple attacks (and multiple payments) continue.
In nearly 70% of attacks, the ransomware victims were targeted multiple times; 31% made multiple payments to attackers. - Identity infrastructure continues to be a prime target as identity recovery preparation lags.
All told, 87% of ransomware attacks targeted identity systems like Active Directory (AD), Entra ID, and Okta. But only about half the companies we surveyed have dedicated identity backups, automated identity recovery solutions, and identity-specific crisis response procedures.
“The bad guys are always evolving their tactics,” said Mickey Bresman, Semperis CEO. “When the initial wave of ransomware attacks began, most focused on data encryption. Then, after data backup and recovery systems started gaining traction and enabling companies to resist ransom demands, we saw the double extortion: encryption coupled with data theft and threats to expose or sell that data. So, it makes sense that we’ll continue to see attackers trying to find more ways to make victims pay.”
Even though identity infrastructure is a prime target for threat actors, identity continues to be at risk in most organizations. In fact, nearly 75% of successful ransomware attacks targeted or exploited the identity system. Only 50% of companies maintain dedicated identity backup systems; and less than half automate identity system recovery. Shockingly, 40% of organizations’ disaster recovery or crisis response plans don’t include procedures for AD recovery.
“Identity is the coin of the realm. If an attacker can steal an identity, they’re off to the races. Insider threats are not always a literal insider—a physical person who’s abusing their authority,” said Inglis. “Often, it’s an internal person acting on an external attacker’s behalf to abuse an insider’s privileges. Sometimes it’s a process that just runs amok. In every case, identity is the core issue.”
The full Ransomware Risk Report can be found here: https://www.semperis.com/ransomware-risk-report/
