RANSOMWARE gangs are increasingly combining cyber extortion with threats of physical harm to senior staff, the latest report from Semperis has warned. The 2026 Ransomware Risk Report, published on 14 October, notes that a quarter of campaigns now use psychological or physical intimidation against executives and other staff in addition to the usual demands for a decryption key and the threat of data leakage. This practice, termed triple extortion, is designed to increase pressure on victims beyond the cyber incident itself.
The study, based on a survey of 1,200 IT and security professionals across North America, the UK, Europe and the Asia‑Pacific, found that 40% of attacks involved psychological or physical threats to employees, an uptick from the previous year. The most common tactics included sending threatening messages or packages to staff (57%), threatening family or friends (37%), and threats of intrusions into offices or homes (19%).
There have already been tangible consequences for some organisations, with 25% reporting doxxing of staff and 23% noting swatting as part of the extortion campaigns. The report highlights the emotional and operational toll on individuals and organisations, underscoring why some victims still choose to pay despite backups or resilience plans.