Semperis has released its 2026 Ransomware Risk Report, highlighting that AI plays a significant role in the ransomware economy. In addition, hackers are increasingly threatening physical and psychological harm against companies’ employees to extract ransom payments.
“An attacker has one goal in mind: they want to extract something from you. And the only way they’re going to do that is to make the cost of resisting their demands greater than the cost of giving in,” said Chris Inglis, the first US National Cyber Director and a Semperis strategic adviser. “Holding you at physical risk is the latest phenomenon because we’ve covered most of the other risks.”
The 2026 Ransomware Risk Report found that bad actors are threatening victims with psychological intimidation in nearly 25% of all attacks in the US, UK, France, Germany, Italy, Spain, Singapore, Canada, and Australia. In 53% of cases, the victims reported that the hackers followed through on their threats; 25% of victims sought psychological and medical treatment as a result of the ransomware attack; and 24% of victims or families hired personal security.
Key findings in the 2026 Ransomware Risk Report include:
- AI is changing the ransomware landscape. In 84% of attacks globally, threat actors weaponised AI.
- Attackers increasingly threaten victimised companies’ staff and their families. Overall, 40% of attacks involved psychological or physical threats against staff. These included threats of abduction and bodily harm.
- Multiple attacks (and multiple payments) continue. In nearly 70% of attacks, the ransomware victims were targeted multiple times; 31% made multiple payments to attackers.
- Identity infrastructure continues to be a prime target as identity recovery preparation lags. In total, 87% of ransomware attacks targeted identity systems such as Active Directory because the acronym is never used again in the text], Entra ID, and Okta. However, only about half the companies surveyed have dedicated identity backups, automated identity recovery solutions, and identity-specific crisis response procedures.
