Ransomware Groups Increasingly Resorting to Real World Threats

The tactics of ransomware groups are constantly changing to increase pressure on victims to give in to their demands. Initially, file encryption alone was sufficient; however, as victims improved cyber resilience and were able to recover their encrypted files from backups, tactics had to evolve. Ransomware groups incorporated data theft into their attacks and started threatening to sell or leak the stolen data if the ransom was paid.

This double extortion approach proved highly successful, with the threat of a data leak alone sufficient to prompt many victims to pay up. Encryption and data leak threats are no longer enough, as the percentage of victims paying ransoms continues to fall. According to a recent survey commissioned by the Identity Threat Detection and Response (ITDR) firm Semperis, the percentage of ransomware victims paying ransoms has fallen from 78% in 2024 to 69% in 2025, and 59% in 2026.

Ransomware groups have responded by adopting more aggressive tactics, and a trend has emerged of ransomware groups issuing personal threats against company employees and their friends and family members. The survey revealed that 37% of ransomware attacks involved threats against friends or family members of staff members, and 41% of respondents to the survey said they had been a target of physical or psychological intimidation.

While contacting individuals whose data was stolen in an attack has been adopted by several groups in the past, the threats have generally been limited to the publication of personal data, but threats are becoming more severe. Ransomware groups are now issuing threats of physical violence and are contacting employees and their friends and family members via text, email, or phone, confirming that they know where they live, work, and even where their children go to school.

Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy The threat of data erasure, destruction, and publication remains the most common tactic (56%), followed by blackmail/extortion (41%), and system lockouts or sabotage (40%); however, 23% of malicious actors have resorted to psychological intimidation, 17% are issuing physical threats, and in 10% of cases, have threatened legal exposure.

Semperis warns in its third annual ransomware report that personal threats are gaining more traction. Out of the individuals who received personal threats, 57% received threatening texts, letters, or packages, 37% received threats about friends and family members, 19% were threatened with physical intrusion, 17% with abduction, 13% with bodily harm, and 6% with stalking.

Semperis said that in 53% of cases, the attackers followed through on their threats. There have been cases of doxxing – exposing personal information – and swatting – triggering an armed police response to a reported threat – which can push victims into ransom negotiations. About 25% of victims reported doxxing, and 23% experienced swatting, according to the survey.

The impact on the individuals concerned has been severe, with around a quarter of the targeted individuals requiring medical or mental health care, and 14% stating they have been forced to change jobs, offices, or homes as a result. Semperis suggests that companies need to respond to these modern threat tactics and should incorporate procedures into their ransomware resilience strategies, including how to respond to attacks involving threats to individuals outside of the organization.

“I’ve spoken with CISOs that had strong relationships with law enforcement,” said Courtney Guss, AVP of Crisis Management, Semperis. “They’ve found it to be a much faster route to information and resources than they would otherwise have found on their own, which can often help them recover more quickly. So, knowing those contacts and building those relationships in advance should be part of your crisis management plan.”

Semperis also recommends strengthening identity resilience, preparing for identity system breaches, and practicing incident response procedures time and again against realistic scenarios, including tabletop exercises involving all team members involved in the ransomware response. The post Ransomware Groups Increasingly Resorting to Real World Threats appeared first on The HIPAA Journal .