# Ransomware Pressure Extends to Employees' Homes and Families: Doxxing, Swatting and Physical Intimidation (Semperis 2026 Ransomware Risk Report)

> Semperis' 2026 Ransomware Risk Report (1,200 IT/security professionals at ransomware-affected organizations) finds extortion pressure now reaches employees' families and homes through threats, doxxing, stalking and swatting. 69% of victims were hit multiple times in 12 months and 87% had identity systems (Active Directory, Entra ID, Okta) targeted or exploited.

- **Published:** 2026-10-19T04:19:23Z
- **Last reviewed:** 2026-10-19T04:19:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3857
- **ID:** TL-2026-3857
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This entry documents a survey-based trend report, not a single campaign or vulnerability. Semperis published its third annual Ransomware Risk Report on 2026-10-14. It is based on a survey of 1,200 IT and security professionals at organizations that had suffered at least one successful ransomware attack. Coverage describes fieldwork in the first half of 2026 across nine countries (U.S., UK, France, Germany, Italy, Spain, Singapore, Canada, Australia) and eight sectors, including finance, healthcare, manufacturing, critical infrastructure and government.

The central finding is that extortion has moved beyond encryption and data-leak threats ('double extortion') to add psychological and physical intimidation of staff, executives and their families ('triple extortion' in Infosecurity Magazine's wording). Reported figures vary slightly by outlet: 37% of respondents said employees' family or friends were threatened; 25% reported doxxing; 23% (24% in the Semperis press release) reported swatting; and 25% said employees or family members needed medical or psychological treatment. Other figures: 24% hired personal security, 14% said staff changed jobs or relocated, and 40-41% reported physical or psychological intimidation overall. Threat types reported include threatening texts, letters or packages (57%), physical intrusion (19%), abduction (17%), bodily harm (13%) and stalking (6%). 53% of respondents said attackers followed through on threats in the past year. The Register notes that the data is self-reported and could not be independently corroborated.

The report also quantifies the technical context. 69% of organizations suffered multiple successful ransomware attacks in the past year and 31% made multiple ransom payments. 59% paid a ransom (down from 69% the prior year and 78% in 2024). 87% reported attacks that targeted or exploited identity infrastructure such as Active Directory, Microsoft Entra ID and Okta. Only about 50% have dedicated identity backups, fewer than 50% automate identity recovery, and about 60% of disaster recovery plans lack identity-system recovery procedures. 84% reported attacker use of AI and 44% reported manipulation of their own AI agents or systems (CSO Online). Help Net Security also notes attackers leaving backdoors and compromised accounts for re-entry.

The sources name no CVEs, malware families or network indicators for this finding. The Register mentions Scattered Spider, ShinyHunters, Lapsus$ and Midnight Blizzard as context for personal-intimidation tactics; it does not make the survey statistics attributable to any of them. Defenders should treat this as a risk-posture and preparedness input: identity-tier hardening and recovery, employee and family safety reporting channels, and incident-response planning that covers personal-targeting scenarios.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1566 Phishing
- T1078 Valid Accounts
- T1078.002 Valid Accounts: Domain Accounts
- T1078.002 Valid Accounts: Domain Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Ransomware pressure now reaches employees' homes and families (Help Net Security)](https://www.helpnetsecurity.com/2026/10/19/semperis-ransomware-employee-safety-report/)
- [Semperis Ransomware Risk Report](https://www.semperis.com/ransomware-risk-report/)
- [Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families](https://www.semperis.com/press-release/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families/)
- [Ransomware Gets Personal (The Register)](https://www.theregister.com/a/5302939)
- [Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/ransomware-threats-physical/)
- [Ransomware extortion gets personal as attackers target employees' families (CSO Online)](https://www.csoonline.com/article/4235782/ransomware-extortion-gets-personal-as-attackers-target-employees-families.html)
- [Ransomware Gangs Embrace Physical Threats, Family Stalking? (Dark Reading)](https://darkreading.com/cybersecurity-analytics/ransomware-gangs-physical-threats-family-stalking)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3857