Ransomware: threats to employees and families to force payment
A Semperis survey of 1,200 affected organizations: intimidation, doxxing and swatting against staff and relatives. What the data says and how to prepare.
Encrypting systems and threatening to leak data is no longer enough: to push a company into paying, some extortion groups are shifting the pressure onto people, meaning employees, executives and their relatives. This is the finding five outlets picked up on 14 and 15 October 2026 from the Semperis 2026 Ransomware Risk Report, a survey carried out in the first half of 2026 among 1,200 IT and security professionals at organizations hit by ransomware, across nine countries and eight sectors including finance, healthcare, manufacturing, critical infrastructure and government.
A necessary caveat: these are self-reported survey answers collected by a security vendor, not individually verified incidents. Dark Reading says so explicitly: reports of threats, stalking and violence are alarming but hard to verify.
What the survey says
The percentages reported by the outlets do not fully match. According to The Register, 37% of attacks involved psychological or physical threats against staff (23% psychological intimidation, 17% physical threats). CSO Online instead reports 41% physical or psychological intimidation and gives 37% as the share of cases in which employees’ friends or family members were threatened, a figure DataBreaches.net also attributes to threats against relatives.
On the rest, the sources agree:
- doxxing of employees or relatives (personal details such as home addresses and phone numbers posted online): 25%;
- swatting, i.e. fake emergency reports that send law enforcement to the victim’s home: 23%;
- employees or relatives who needed medical or psychological treatment: 25%;
- companies that hired additional security staff: 24%.
Only CSO Online reports that around 14% had to change jobs, offices or homes. Only The Register reports that 53% of respondents say threats were carried out in the past year, broken down as follows: threatening texts, letters or packages 57%, threats against family or friends 37%, physical intrusion 19%, abduction 17%, bodily harm 13%, stalking 6%. Again according to The Register, 69% of respondents were hit more than once in the past 12 months and 31% paid more than once.
How the attackers work
The mechanism described by the sources is reconnaissance into the private lives of key people, on top of classic double extortion. According to an expert quoted by CSO Online, attackers combine social and professional profiles, data broker databases, data already leaked in earlier breaches and information found inside the victim company’s network; artificial intelligence speeds up the correlation and the personalization of threats.
A Semperis incident response consultant interviewed by The Register describes cases in which executives received photos of their children’s schools directly from the criminals during negotiations, and speaks of “violence as a service”. In his view these tactics are used by the better-known groups, and he names Scattered Spider, ShinyHunters and Lapsus$; ShinyHunters, in an interview with the same outlet, denies attacking people. The Register also gives some context: in summer 2026 Europol and its partners flagged 4,340 URLs for removal as part of investigations into The Com, a network of online groups whose often very young members move from hacking to swatting and physical violence.
In our reading, the preparatory phase maps to these MITRE ATT&CK entries: Gather Victim Identity Information (T1589), Gather Victim Org Information: Identify Roles (T1591.004), Search Open Websites/Domains: Social Media (T1593.001) and Search Closed Sources (T1597); the end goal is Financial Theft (T1657). There are no CVEs or specific malware to detect.
The survey also covers artificial intelligence and identity: according to CSO Online, 84% of respondents experienced attacks involving AI, 87% attacks on identity infrastructure and 44% the manipulation of their own AI agents or systems.
Impact for European and Italian companies
The sources do not give a country breakdown, so it is not possible to say how far the phenomenon affects Italy. The point for security leaders is a different one: incident response plans usually cover systems and data, not the protection of people.
Under NIS2 (Italian Legislative Decree 138/2024), incident handling, business continuity, crisis management and human resources security are among the mandatory measures for essential and important entities: personal threats linked to an attack are squarely part of the crisis scenario. Under the GDPR, employee data stolen from the corporate network (personal records, addresses, family members) is a personal data breach to be assessed for notification to the supervisory authority within 72 hours, and it is exactly the material that makes these threats possible. In healthcare, where the pressure to restore services is already intense, the burden on people makes the crisis even worse.
What to do now
- Add personal threats to the incident response plan: who receives them, how they are documented, when and how HR, legal, IT security and physical security involve law enforcement. Threats, stalking and extortion are crimes: report them immediately.
- A confidential channel for employees who receive intimidating messages, packages or calls, including at home.
- Reduce the employee personal data stored and reachable on the network: HR folders, spreadsheets with addresses and family members, forgotten exports. Restrict access and monitor who reads them.
- Protect identities: phishing-resistant authentication for privileged accounts, least privilege, backups of the identity infrastructure with tested restores.
- AI agents with an owner, limited permissions and human approval for high-impact actions, as suggested by the experts quoted by CSO Online.
- Exercises that include the scenario: compromised identities, threatened data leaks and threats against executives’ families.
- Reduce the public exposure of key roles: detailed org charts, direct contacts and easily linkable personal information.
How ARXDOME helps
Threats against people are handled with processes and the authorities, but they almost always start from an intrusion. ARX Expose flags corporate accounts exposed in breaches and domains similar to yours, typical reconnaissance material. ARX Sentry, in the SOC identity pages, shows privileged logons, night-time logons and account changes, and its file integrity monitoring flags changes in the chosen folders, such as those holding staff data. ARX Shield isolates a suspicious machine with one click and ARX Trace collects the evidence to reconstruct what was taken.
Last updated:
