Ransomware extortion is increasingly spilling beyond corporate networks, with victims reporting threats against employees, relatives and friends, according to a new Semperis survey. The claims include doxxing, stalking, physical intrusion, abduction and bodily harm, although the survey records what organizations reported rather than independently verified kidnappings or assaults.
Semperis surveyed 1,200 organizations that had experienced ransomware during the first half of 2026. Thirty-seven percent said attackers had threatened employees’ friends or family members, while 41% reported physical or psychological intimidation. The report says 23% encountered psychological intimidation and 17% physical threats, underscoring how extortion negotiations are moving into victims’ personal lives.
The reported tactics ranged from threatening texts, letters or packages to more serious allegations. Nineteen percent of respondents reported physical intrusion, 17% reported abduction threats, 13% reported threats of bodily harm and 6% reported stalking. The figures should not be read as a count of confirmed crimes: Semperis does not establish that an attacker carried out every reported threat or that the claims were validated by law enforcement.
Personal-data exposure is a key enabler. One-quarter of respondents said employees or family members were doxxed, while 23% reported swatting and 24% said victims or relatives hired additional security. The report also says 25% sought medical or psychological treatment and 14% changed jobs, offices or residences because of sustained threats. Semperis said 53% of respondents reported that attackers followed through on threats, but it did not specify how many of those cases involved physical violence, abduction or stalking.
For defenders, the findings broaden the incident-response problem beyond encryption, data theft and business interruption. Security teams should treat leaked personnel records, home addresses, phone numbers and family details as sensitive breach material; preserve messages, caller information, payment demands and logs; and coordinate quickly with legal, communications, human-resources and physical-security teams. There is no CVE or software patch associated with these reported tactics, and the survey does not attribute them to one specific ransomware group.
CISA’s StopRansomware guidance says organizations should immediately isolate affected systems, preserve evidence and report incidents to CISA, the FBI’s Internet Crime Complaint Center or a local FBI field office. Where a message names an employee or family member, organizations should also involve local law enforcement and advise the threatened person not to engage independently with the sender. The reported rise in personal intimidation is serious, but its most extreme elements remain self-reported and difficult to verify.
