Ransomware gangs are increasingly turning to threats of physical violence against CISOs, business executives and other senior staff at the companies they attack in an effort to successfully extort payments from their victims, a new report has warned.

According to the Semperis 2026 Ransomware Risk Report, published on October 14, a quarter of ransomware campaigns now involve psychological or physical threats to members of staff at the company being targeted.

These threats are in addition to the extortion demand for a ransomware key to retrieve the encrypted data, as well as the threat of stolen data being leaked if the ransom isn’t paid.

This approach is referred to as triple extortion.

Overall, 40% of attacks involved psychological or physical threats against staff at the company being targeted, an increase compared with the previous year.

Some of the most common forms of intimidation used by ransomware gangs in these scenarios include sending staff at the victim organization threatening messages, letters or packages (57%), threatening family and friends of employees (37%) and threats of physical intrusions into offices or even homes (19%).

This additional layer of intimidation is designed to force victims of ransomware attacks into paying. Even if an organization is confident it could restore its network from backups, the threat of physical or emotional violence against its staff could encourage the payment of a ransom anyway.

“An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in,” said Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor.

“Holding you at physical risk is the latest phenomenon because we've covered most of the other risks.”

Doxxing, Swatting and Other Threats

Unfortunately, the threats by ransomware groups against employees of their victims have resulted in very real consequences. Of those organizations affected by ransomware gangs employing these tactics, 25% said their staff had been doxxed by attackers, while 23% suggested that employees had been swatted as part of the extortion campaigns.

The consequences of these attacks have ranged from companies having to support employees through psychological treatment and in some cases, the victim of the doxxing or swatting attack has moved home.

All of this involves a significant amount of emotional trauma for the individuals being targeted, while the stress caused can also impact individuals throughout the business.

“Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm,” said Mickey Bresman, Semperis CEO.

The Semperis research was based on a survey of 1,200 IT and security professionals across North America, the UK, Europe and the Asia-Pacific.