Ransomware groups increase physical violence and psychological threats against employees

Ransomware groups are escalating extortion tactics by using real world threats against company employees, executive officers, and their family members to force ransom payments. The HIPAA Journal and InfoSecurity Magazine both report that gangs are resorting to threats of physical violence alongside psychological intimidation to compel victim organizations to pay. [1][2]

The tactics include doxxing, swatting, and targeted threats against chief information security officers, business executives, and senior personnel. InfoSecurity Magazine reported that the Semperis 2026 Ransomware Risk Report, published on October 14, found that a quarter of ransomware campaigns now involve psychological or physical threats against staff members at target companies. [1][2]

Extortion methods have evolved because organizations improved their cyber resilience and can often restore encrypted systems from backups. Cybercriminals initial reliance on file encryption changed to data theft, where groups threatened to leak or sell exfiltrated data, before adopting direct physical threats. [1][3]