RANSOMWARE gangs are expanding their extortion beyond encrypting files to targeting employees and their families. The piece cites the Semperis 2026 Ransomware Risk Report, which found that 37% of successful attacks included threats against workers’ friends or relatives, signalling a shift from purely technical incidents to safety and mental health risks for staff.
The report, based on a survey of 1,200 IT and security professionals from organisations hit by ransomware in the prior 12 months across nine countries and eight sectors during the first half of 2026, documents a range of threats. Among respondents, 57% reported threatening texts, letters, or packages; 19% faced threats of physical intrusion; 17% reported threats of abduction; and 13% saw threats of bodily harm. Doctored or direct threats were carried out in 53% of reported cases. The personal impact was substantial: a quarter of affected organisations said employees or family members were doxxed.
The piece also notes swatting in 23% of cases, with some victims requiring medical or mental health care (25%), while 24% hired personal security. In 14% of cases, staff or relatives changed jobs, offices, or homes due to the pressure. The narrative emphasises that ransomware groups are increasingly using personal coercion and threats to coerce payment, adding a new dimension to extortion beyond data leakage or file encryption.