Ransomware Gangs Target Employees’ Families as Organizations Face Repeat Attacks, Semperis Report Finds

Ransomware attackers are increasingly targeting employees’ families and personal lives, according to Semperis’ 2026 Ransomware Risk Report. Among 1,200 IT and security professionals surveyed—each from organizations that suffered at least one successful ransomware attack—37% reported threats directed at employees’ family members or friends.

Respondents described threatening messages, stalking, and intimidation designed to pressure victims into paying ransoms. A quarter said employees or their families required medical or psychological treatment due to ransomware‑related threats. Another 23% reported swatting incidents, where attackers filed false emergency reports to send police to victims’ homes. Doxxing was also common, with some employees needing security protection or relocating to new jobs, offices, or homes.

Semperis CEO Mickey Bresman said criminal groups now blend cyber and physical intimidation: “Ransomware has proven to be a great cash‑generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm.”

The report recommends documenting response roles across the organization and including procedures for threats against people outside the workplace. Establishing relationships with law enforcement before an incident is also advised. Semperis Senior Incident Response Consultant Tim Beasley noted the toll on staff: “IT and cybersecurity teams are already dealing with high stress. A ransomware attack takes that to a whole new level.”

Some 69% of surveyed organizations experienced multiple successful ransomware attacks within the previous year. Pressure to restore operations often leads teams to bring systems back online before confirming attackers have been fully removed. Malware, backdoors, and compromised accounts can leave intruders with a path back into the environment, enabling repeat attacks.

Ransom payments remain common, with 59% of respondents saying their organization paid. Motivations included protecting customer data, limiting disruption, and reducing reputational damage. Some paid because they could not remove attackers from their environment. Payment, however, provides no guarantee of data recovery or safe restoration. Decryption keys may be buggy, malicious, or incomplete, and organizations still need to rebuild systems to a trusted state.

Identity systems were targeted or exploited in 87% of attacks. Services such as Active Directory, Entra ID, and Okta manage accounts and permissions across the enterprise, making them high‑value targets. Criminal control of identity infrastructure allows privilege escalation, lateral movement, and interference with recovery. Half of surveyed organizations had dedicated identity backups, which help restore access without carrying compromised settings into rebuilt environments.

Respondents cited evolving threats, outdated systems, technical debt, and regulatory pressure as major challenges to maintaining operations and recovering from attacks. They also pointed to outdated crisis plans, unclear roles, and communication gaps between teams as barriers during incident response.