Ransomware Gets Personal: 37% of Attacks Now Include Direct…

A Semperis survey of 1,200 organizations hit by ransomware in the first half of 2026 finds that 37% of attacks involved psychological or physical threats against personnel. The Register published the findings on October 14, 2026, detailing tactics such as photos of executives' children's schools, packages delivered to investigators, and swatting calls. The analysis rests on a single independent primary source for this specific phenomenon.

Ransomware has extended its target beyond the datacenter. According to the annual Semperis report, based on 1,200 post-attack organizations in the first half of 2026, 37% of attacks included direct psychological or physical threats against staff. The Register published the data on October 14, 2026, which includes photos of children's schools sent to executives, packages delivered to investigators, and swatting calls. This analysis is based on a single independent primary source on the specific phenomenon.

Key Takeaways

37% of ransomware attacks in the first half of 2026 involved personal threats, according to a Semperis survey of 1,200 organizations.
Tim Beasley, former Microsoft DART lead investigator and now Semperis consultant, received Russian nesting dolls and souvenirs at home during a Midnight Blizzard investigation.
53% of respondents report that attackers followed through on threats in the past year; it is unclear whether physical threats materialized into direct acts of violence.
ShinyHunters denies "attacking human beings" but admits to pushing "the corporate to the absolute limit," a stance in tension with Beasley's classification.

The Survey: Numbers and Methodology

The Semperis report collected data from 1,200 post-ransomware organizations in the first half of 2026. 37% of attacks included psychological or physical threats against personnel. Of these, 23% involved psychological intimidation and 17% involved physical threats.

Among the documented consequences: 25% of victims suffered doxxing, 25% sought psychological or medical treatment, 24% hired personal security teams, and 23% received swatting calls. 53% of respondents report that attackers carried out threats in the past year.

Among concrete threats, 57% consist of threatening messages, letters, or packages, and 37% involve threats against family or friends. The sampling method for the 1,200 organizations is not specified in the source.

"We-Know-Where-You-Are Kind of Stuff": An Investigator's Account

Tim Beasley, Semperis senior incident response consultant and former Microsoft DART lead investigator, described to The Register an episode that occurred during an investigation into Midnight Blizzard, a Russia-linked APT. He received a package at home containing Russian nesting dolls and souvenirs.

"We-know-where-you-are kind of stuff. It's a real eye-opener when you get that type of thing," Beasley stated. In the same interview, he recounted investigating cases where executives received photos of their children's schools, obtained through social media reconnaissance.

Beasley also documented the use of "violence as a service." He stated: "I've seen threats involving people's families, from social media reconnaissance, and in our world you more and more come to expect it, which is unfortunate."

The Conflict: What the Groups Say

Beasley names Scattered Spider, ShinyHunters, and Lapsus$ among the groups adopting psychological and physical pressure. ShinyHunters, in an exclusive interview with The Register, denied "attacking human beings" with the formula "Don't attack human beings."

In the same interview, the group admitted: "There are times in the work we do sometimes we have to push the corporate to the absolute limit to get them on the table." This tension between the denial of harm to individuals and the admission of extreme pressure on corporations remains unresolved in the available material.

Re-infection and Multiple Payments

The survey reports that 69% of ransomware victims were targeted multiple times in the past year and 31% made multiple payments. Beasley reiterated: "Don't pay anything. Never pay them."

On incident response, Beasley stated: "Stand your ground. Don't buckle under the pressure, and just know that you know it's going to be okay. If you feel like you're under duress, then by all means get law enforcement involved. Don't be afraid to call the cops. Don't be afraid to get the FBI involved, sooner rather than later. And don't pay them." The phrase "sooner rather than later" refers to the moment one feels under duress, not to pre-incident preparation.

"We've seen violence as a service get used. I've seen threats involving people's families, from social media reconnaissance, and in our world you more and more come to expect it, which is unfortunate." — Tim Beasley, senior incident response consultant Semperis, former lead investigator Microsoft DART

The Europol Operational Context

The dossier mentions a Europol and partner operation against The Com, a network of online groups with young members involved in hacking, swatting, digital extortion, real-world shootings, and other physical violence. The operation led to the reporting of 4,340 URLs for takedown. The Com is not classifiable as a ransomware group in the source.

What Changes

Personal threats alter the perimeter of incident response. When the attacker contacts personnel outside corporate channels, IT teams must coordinate with non-technical resources: personal security, psychological support, law enforcement.

The data point that 25% of victims sought psychological or medical treatment, and 24% hired personal security teams, indicates costs not covered by traditional cyber insurance policies. The 23% of victims who experienced swatting requires verification protocols with local law enforcement.

The source does not specify technical mitigations for this vector. Beasley's recommendation to involve law enforcement "sooner rather than later" when feeling under pressure remains the only documented operational advice for the specific case.

The main limitation of the data: it is unclear whether physical threats materialized into direct acts of violence or remained primarily threats. The 53% of threats "carried out" in the survey's terminology does not equate to confirmation of physical violence.

Information is based on the cited source and current as of publication.

Sources

Sources and references

Get DeafLetter