Ransomware is no longer just about encrypted files and data leaks. According to Semperis’ annual ransomware risk report, 37% of attacks now involve psychological or physical threats against staff. The global survey of 1,200 post-ransomware organizations found 23% faced psychological intimidation and 17% physical threats, with attackers targeting not only executives but also their families. Reported threats include threatening texts, letters, or packages (57%), threats against family or friends (37%), physical intrusion (19%), abduction (17%), bodily harm (13%), and stalking (6%). A quarter of victims experienced doxxing, and 23% were hit with swatting calls.
Tim Beasley, a senior incident response consultant at Semperis and former lead investigator for Microsoft’s DART team, described receiving a package of nesting dolls and regional gifts from Russia’s Midnight Blizzard group during an investigation. “We-know-where-you-are kind of stuff,” he told The Register. He has also seen C-suite executives receive pictures of their kids’ schools. The report found 53% of attackers carried through on threats, and 69% of victims were targeted multiple times within 12 months.
Dark Reading’s coverage of the same trend strikes a more cautious note, observing that these alarming claims are difficult to verify. While The Register’s source provides detailed survey data and expert testimony, the second outlet highlights the challenge of independently confirming such incidents. Both agree that ransomware gangs are increasingly blending digital extortion with real-world intimidation, but the verifiability of these threats remains an open question.
Beasley’s advice to defenders: “Stand your ground. Don’t buckle under the pressure.” He urges victims to involve law enforcement early and never pay, since paying invites repeat attacks. The report shows 31% of victims made multiple payments, reinforcing that capitulation rarely ends the ordeal.