Ransomware Groups Target Staff With Physical Threats and Stalking

Ransomware operators are expanding their extortion methods beyond data encryption and leakage threats to include direct physical and psychological intimidation of employees. This shift targets senior staff, including CISOs and business executives, to pressure organizations into paying ransoms. The tactic aims to make the personal cost of resisting the attack higher than the financial cost of compliance, effectively bypassing technical defenses like backups.

What is triple extortion?

Triple extortion combines traditional ransomware demands with threats to leak stolen data and new threats of harm to employees. According to the Semperis 2026 Ransomware Risk Report, published on October 14, a quarter of ransomware campaigns now involve these psychological or physical threats. Overall, 40% of attacks involved psychological or physical threats against staff, an increase compared with the previous year. The addition of personal risk is designed to force payment even when organizations can restore systems from backups without paying.

How do attackers intimidate victims?

Attackers use several methods to instill fear in targeted employees. The most common tactic, used in 57% of these cases, involves sending threatening messages, letters, or packages directly to staff. In 37% of instances, gangs threaten the family and friends of employees. Less frequently, 19% of attacks involve threats of physical intrusion into offices or homes. These actions are intended to create immediate personal danger and anxiety, compelling the organization to negotiate and pay to ensure the safety of its personnel.

What are the real-world consequences?

The escalation to physical threats has resulted in tangible harm for affected organizations and their staff. Among companies facing these tactics, 25% reported that their employees were doxxed by attackers, exposing personal information publicly. Additionally, 23% indicated that employees were subjected to swatting, where false emergency reports are made to send armed police to a residence. Some victims have had to move homes, and companies have needed to provide psychological treatment and support for staff dealing with the trauma of these campaigns.

Why are gangs changing tactics?

Attackers are driven by the goal of maximizing extraction value by increasing the cost of resistance. Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor, noted that holding victims at physical risk is a new phenomenon because other risk vectors are largely covered. By introducing personal safety concerns, gangs create a scenario where technical resilience is insufficient to deter payment. The strategy relies on making the emotional and physical toll on staff unbearable, thereby forcing financial capitulation.

What analysts watch for

Security teams should monitor for unusual outbound communications or data exfiltration that could signal reconnaissance for physical targeting. Analysts typically examine employee personal information exposure to assess doxxing risks. They also review incident response plans to ensure they address threats against staff safety, not just system recovery. Teams usually coordinate with local law enforcement when physical threats are made, rather than handling them solely as cyber incidents. Checking for signs of stalking or harassment against key personnel is also a critical step in this evolving threat landscape.

Background: Incident response plans

Create a documented plan that defines roles, communication channels, and containment steps before an attack. Test it with tabletop exercises to find gaps. Update it regularly to reflect new threats and team changes.

Read the full guide: Build an Incident Response Plan That Actually Works

What to do and how to stay safe: Semperis

• Review incident response plans to include protocols for threats against employee safety and family members.
• Conduct privacy audits to minimize exposure of personal employee data that could be used for doxxing.
• Establish clear communication channels for staff to report harassment or threats without fear of reprisal.
• Coordinate with local law enforcement early if physical threats or stalking are reported during an incident.

Step-by-step guide: How Windows Malware Removal Works: The Hidden Persistence Layer

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What percentage of ransomware attacks involve threats to staff?

According to the Semperis 2026 Ransomware Risk Report, 40% of attacks involved psychological or physical threats against staff, an increase from the previous year.

What is the most common form of intimidation used?

The most common form is sending threatening messages, letters, or packages to staff, which occurred in 57% of these scenarios.

Have these tactics resulted in actual harm?

Yes, 25% of affected organizations reported staff doxxing, and 23% reported swatting incidents, with some employees needing to relocate or receive psychological treatment.