Summary

• Semperis surveyed 1,200 ransomware-affected organisations across nine countries, including the UK, and reports psychological or physical threats against staff in 40% of attacks.
• The company says AI was used by attackers in 84% of incidents, while nearly 70% of respondents reported repeated targeting and 31% multiple ransom payments.
• Identity infrastructure was targeted in 87% of reported attacks, although only about half of surveyed organisations had dedicated identity recovery preparations.

Ransomware attackers are directing threats at employees and their families as well as the systems they compromise, according to new research that describes repeated extortion attempts and continuing weaknesses in organisations’ ability to restore trusted identity infrastructure.

Semperis surveyed 1,200 organisations that had experienced ransomware attacks during the preceding 12 months, including businesses and public institutions in the UK, continental Europe, North America and Asia Pacific.

The company reports that 40% of the attacks involved psychological or physical threats against staff, while nearly 70% of respondents said they had been targeted more than once. Criminal demands also extended beyond the initial ransom, with 31% reporting multiple payments.

Published on 14 October, the Semperis 2026 Ransomware Risk Report concentrates on organisations already affected by attacks. The findings therefore describe the experiences of victims, not the proportion of all organisations likely to face ransomware or personal threats.

Extortion creates risks beyond data loss

Ransomware incidents can involve several forms of pressure, including encrypting systems, stealing information and threatening to release confidential material. The latest research describes criminals pursuing employees and other individuals connected with their targets.

Reported tactics include intimidating staff, threatening family members and using personal information to create fear that resisting a demand could lead to consequences outside the workplace.

Semperis says respondents reported attackers following through on some threats, including harassment and the misuse of emergency services. The release also refers to cases in which victims or family members sought medical or psychological support and arranged personal security.

These are serious reported experiences, although the survey does not establish that every threat involved an intention to cause physical harm or that each reported instance of follow-through resulted in violence.

Nor should a figure describing psychological and physical intimidation be presented as the percentage of victims physically assaulted. Those categories can have different meanings and consequences, and the company’s published summary does not provide enough detail to combine them into one measure of actual physical injury.

The development nevertheless changes what organisations may need from an incident response plan. An employee whose address has been exposed or whose family has been threatened requires a response extending beyond restoring servers and resetting passwords.

Security teams may need to work with human resources, legal advisers, senior management and police to protect people while the technical investigation continues.

Those responsibilities are particularly demanding when employees are simultaneously under pressure to restore critical business services.

Repeated targeting complicates ransom decisions

The research found that nearly seven in ten affected organisations reported more than one ransomware attack during the survey period. Separately, 31% of respondents said they had made multiple payments to attackers.

Repeated attacks and repeated payments are related concerns, but they do not establish that one particular payment caused a subsequent incident.

A compromised organisation may remain exposed because attackers retain credentials or access routes, while another incident might involve a different criminal group exploiting an unrelated weakness.

Paying a ransom also does not independently guarantee that stolen information has been destroyed, that an attacker has left the environment or that affected systems can be restored safely.

For businesses assessing the financial consequences, the cost can therefore extend beyond the initial demand. Forensic investigation, legal advice, recovery work, operational interruption, customer communications and employee support may continue after a payment decision has been made.

Multiple attacks can also create cumulative disruption. Systems restored after one incident may need to be investigated again if new malicious activity is detected, particularly where the organisation has not established how the original intrusion occurred.

Semperis has not published sufficient evidence in its announcement to attribute every repeat attack to the same perpetrators or quantify the financial losses resulting from repeated extortion across the surveyed population.

Its figures instead identify a substantial reported problem among organisations already selected for the study because they had experienced ransomware.

AI use is widely reported but difficult to attribute

Semperis reports that attackers used artificial intelligence in 84% of the incidents covered by the survey.

The finding reflects respondents’ accounts and the company’s interpretation of the attacks, rather than an independently published forensic reconstruction of every incident.

AI could support several parts of an operation, including preparing convincing communications, processing stolen information or accelerating tasks that previously required more manual effort.

However, the presence of AI in an attack does not establish that it was responsible for the initial compromise, that it made the operation successful or that criminals used autonomous agents capable of acting without human supervision.

Those distinctions affect how the findings should inform security investment. Organisations still need effective identity controls, monitoring, patching and recovery arrangements regardless of whether an attacker uses AI to assist with part of an operation.

Defensive teams may also use automation to examine large volumes of security information, but its effectiveness depends on the quality of detection rules, underlying data and human investigation.

Neither the use of AI by attackers nor the deployment of AI-based defences removes the need to establish which systems were compromised and what actions occurred.

Identity infrastructure remains a major target

According to Semperis, identity infrastructure was targeted or exploited in 87% of the ransomware incidents reported by respondents.

Services such as Microsoft Active Directory, Microsoft Entra ID and Okta can control access to applications, establish user identities and manage permissions across an organisation.

Compromising those systems may allow attackers to impersonate legitimate users, obtain privileges and interfere with efforts to investigate or contain an intrusion.

Restoring conventional application data is consequently not enough if employees and administrators cannot trust the identities used to access those applications.

A business might recover files from backup while retaining malicious account permissions or compromised administrative credentials, potentially allowing an attacker to regain access to restored systems.

Reliable recovery can require clean identity backups, procedures for rebuilding directory services, verification of account privileges and changes to credentials used across connected applications.

Those activities have technical dependencies. A restored authentication system may need to be reconnected safely to applications, cloud services and infrastructure that expect specific identities and trust relationships.

Semperis says only about half the organisations surveyed maintained dedicated identity backups, automated recovery arrangements and identity-focused crisis response procedures.

The summary does not establish that the same half of organisations possessed all three measures. Each capability should be considered separately when evaluating preparedness.

The distinction between restoring information and restoring trust is especially relevant to organisations with mixed cloud and on-premises infrastructure, where identity services may connect many systems used for routine operations.

Staff protection joins the resilience agenda

Semperis develops identity security and recovery products, giving it a commercial interest in emphasising the importance of identity infrastructure. Its research nevertheless describes risks extending beyond its particular technology category.

Companies facing personal threats need procedures for identifying affected employees, escalating credible concerns, contacting appropriate authorities and supporting people whose information has been misused.

Those arrangements should be coordinated with the technical response rather than left to individual employees under pressure from criminals.

Identity recovery exercises can also help organisations understand whether they can restore access controls without recreating the conditions that allowed an intrusion.

Because the research includes only ransomware victims and relies on reported experiences, it cannot determine the overall prevalence of every tactic across all businesses. The study also provides no basis for claiming that an individual organisation’s next incident will necessarily involve AI-assisted attacks or personal intimidation.

For the affected organisations surveyed, however, the combination of repeated extortion, identity compromise and threats against staff demonstrates that recovery planning must account for people as well as technology.

Further evidence will be needed to establish how those tactics are changing over time, particularly where annual studies use different respondent populations or definitions. The immediate operational requirement is to ensure that a compromised identity system and a threatened employee can each be supported through a tested response procedure.