Ransomware gangs target families with physical threats and AI tools

Ransomware operators are increasingly threatening the personal safety of employees and their families to force corporate ransom payments. This shift moves extortion beyond digital encryption and data theft into physical intimidation and psychological pressure. According to Semperis, these tactics are designed to bypass organizational defenses by targeting the human element directly.

In plain English

Attackers no longer rely solely on locking files or stealing data. They are now using artificial intelligence to enhance their operations and exploiting an organization’s own AI systems. The goal is to create maximum distress for the company by harming its people. This includes sending threatening messages, packages, or letters to staff and their relatives, aiming to disrupt work and force compliance through fear rather than technical leverage.

The background

The Semperis 2026 Ransomware Risk Report, released in the first half of 2026, surveyed 1,200 IT and security professionals across nine countries and eight sectors. These sectors included finance, healthcare, manufacturing, critical infrastructure, and government. The study found that 87% of victims reported attacks targeting identity infrastructure. Additionally, 84% experienced attacks involving AI, indicating a widespread adoption of these technologies by threat groups.

What changes now

The impact of these attacks extends significantly beyond the corporate network. Forty-one percent of respondents reported physical or psychological intimidation, while 37% said employees’ friends or family members were threatened. Doxing occurred in 25% of cases, and swatting was reported in 23%. About 25% of affected individuals required medical or psychological treatment. Twenty-four percent hired additional security, and 14% were forced to change jobs, office locations, or move homes.

What made it possible

Security teams usually focus on perimeter defenses and data backups, which leaves human targets exposed. Attackers exploit the gap between digital security controls and personal safety. To mitigate this, organizations should assess how well they protect employee identity data and monitor for signs of social engineering aimed at staff. Check whether incident response plans include protocols for physical threats or harassment. Ensure that sensitive personal information is not accessible to attackers who might use it for intimidation.

Background: Ransomware

Ransomware is malicious software that encrypts your files, making them unreadable until you pay a fee. It often arrives via email attachments or malicious downloads. You can prevent it by keeping backups offline, updating software, and verifying links before clicking.

Read the full guide: Ransomware Explained: How File Locking Works and What to Do

What to do and how to stay safe: Semperis

• Review incident response plans to include procedures for handling threats against employees and their families.
• Monitor for signs of social engineering or phishing attempts that could harvest personal data for doxing.
• Ensure employee identity information is protected and not exposed in breach scenarios.
• Train staff to recognize and report suspicious communications or physical threats immediately.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How common are AI-related ransomware attacks?

According to the Semperis report, 84% of surveyed ransomware victims experienced attacks involving AI.

What percentage of victims faced threats to their families?

Thirty-seven percent of respondents said employees’ friends or family members had been threatened.

Did any victims have to move homes due to these attacks?

Around 14% were forced to change jobs, office locations, or move to a new home.