Ransomware gangs now threaten employees’ families, survey finds
Ransomware operators are increasingly pressuring victims through their personal lives, according to Help Net Security, which summarises Semperis’ 2026 Ransomware Risk Report. Attackers threatened employees’ family members or friends at 37% of the organizations surveyed. The findings come from a survey, not from a single confirmed incident, and no specific threat group is named.
What we know
The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack. Respondents described several kinds of pressure aimed at staff:
- Threatening messages, stalking and threats of physical harm.
- Swatting, a false emergency report that sends police to a person’s location, reported by 23%.
- Doxxing, meaning personal information exposed online without consent.
A quarter of respondents said employees or their family members needed medical or psychological treatment because of ransomware threats. Some employees needed security protection, or changed jobs, offices or homes after an attack. Semperis CEO Mickey Bresman said criminal syndicates have “no hesitation about inflicting both cyber and physical harm.”
Who is affected
The people most exposed are those who handle the response and those whose details attackers can find: IT and security staff, executives and their relatives. Semperis incident response consultant Tim Beasley noted that responders already face high stress, and the report links the personal pressure to burnout and staff leaving.
The survey also points to repeat compromise and payment trends:
- 69% of organizations had multiple successful ransomware attacks within the previous year.
- 59% said their organization paid a ransom, citing protection of customer information, limiting disruption and containing reputational damage. Some paid because they could not remove the attackers.
Why this matters
Analysis, not reported fact: threats against families change who needs to be inside the incident plan. Most runbooks cover systems and data; few cover an employee’s spouse receiving a threatening message or a police unit arriving at someone’s home. Pressure on people can also push teams to rush a restoration, which is where the repeat-intrusion risk the survey describes comes from.
What has not been confirmed
The report is survey-based and self-reported. The source does not name the ransomware groups behind the threats, does not say how attackers obtained family details, and does not give an overall number of incidents beyond the surveyed organizations.
How to recover without being re-compromised
According to the report, recovery means finding how criminals entered, removing their access and checking the systems being restored. Malware, backdoors and compromised accounts can give intruders a way back. Restoring before confirming the attackers are gone leaves weaknesses open for another intrusion. A decryption key does not remove the need to rebuild the environment to a trusted state, and payment gives no guarantee of recovering data or access.
What to do
- Document response roles across the organization and add procedures for threats against people outside the workplace, such as employees’ family members.
- Build relationships with law enforcement before an incident, so you know who to call about stalking, swatting or threats of violence.
- Tell staff what support exists (security protection, counselling, time off) and how to report threats made against them or their families.
- Before restoring services, establish the initial access path, remove attacker access and check restored systems; hunt for backdoors and compromised accounts, and reset credentials as part of recovery.
- Rebuild affected systems to a trusted state even if a decryption key is obtained.
- Review who in leadership decides on ransom payments and how, since the report says payment is no guarantee of recovery.
