According to Semperis' 2026 Ransomware Risk Report, based on a survey of 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack, 37% said attackers threatened employees' family members or friends. The tactics go beyond the workplace, with respondents describing threatening messages, stalking, and threats of physical harm.
The personal toll is significant. A quarter of respondents said employees or their family members needed medical or psychological treatment, and 23% reported swatting. Some employees required security protection or changed jobs, offices, or homes. The report recommends documenting response roles, including procedures for threats against people outside the workplace, and building relationships with law enforcement before an incident.
The survey also found that 69% of organizations experienced multiple successful ransomware attacks in the previous year, and 59% paid ransoms. Payment does not guarantee recovery, and decryption tools can be buggy or contain malicious code. Attackers targeted or exploited identity systems in 87% of cases, but only half of organizations had dedicated identity backups, which complicates restoring access without carrying compromised settings into the rebuilt environment.