Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families

News provided by

Oct 14, 2026, 01:00 ET

The study reveals AI is reshaping ransomware as repeat attacks, threats to employees and their families, and attacks on identity systems outpace recovery readiness.

HOBOKEN, N.J., Oct. 14, 2026 /PRNewswire/ -- Semperis, the identity-driven cyber resilience and crisis response company, today published results from its annual global ransomware report, highlighting that AI plays a significant role in the ransomware economy. In addition, hackers are increasingly threatening physical harm against companies' employees to extract ransom payments; in more than half the reported cases, the attackers followed through on those threats. Only organizations that were victimized by ransomware gangs in the past 12 months were included in the study.

"An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in," said Chris Inglis, the first U.S. National Cyber Director and a Semperis Strategic Advisor. "Holding you at physical risk is the latest phenomenon because we've covered most of the other risks."

The 2026 Ransomware Risk Report, found that bad actors are threatening victims with psychological intimidation in nearly 25% of all attacks in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia. In 53% of cases, the victims reported that the hackers followed through on their threats; 23% of victims or family members were swatted; 25% of victims sought psychological and medical treatment because of the ransomware attack; and 24% of victims or families hired personal security.

"IT and cybersecurity staff are already dealing with high levels of stress," says Tim Beasley, Semperis Senior Incident Response Consultant. "A ransomware attack takes that to a whole new level. I have seen CISOs say, 'I'm out. I'm done. I can't do this. It isn't worth it.' I've seen people walk out the door because leadership thought they mismanaged something that caused the breach to occur. It all takes a mental toll."

Key Findings

AI is changing the ransomware landscape.
In 87% of attacks, threat actors weaponized artificial intelligence.

Attackers increasingly threaten victimized companies' staff and their families.
Overall, 40% of attacks involved psychological or physical threats against staff.

Multiple attacks (and multiple payments) continue.
In nearly 70% of attacks, the ransomware victims were targeted multiple times; 31% made multiple payments to attackers.

Identity infrastructure continues to be a prime target as identity recovery preparation lags.
All told, 87% of ransomware attacks targeted identity systems like Active Directory (AD), Entra ID, and Okta. But only about half the companies we surveyed have dedicated identity backups, automated identity recovery solutions, and identity-specific crisis response procedures.

"The bad guys are always evolving their tactics," said Mickey Bresman, Semperis CEO. "When the initial wave of ransomware attacks began, most focused on data encryption. Then, after data backup and recovery systems started gaining traction and enabling companies to resist ransom demands, we saw the double extortion: encryption coupled with data theft and threats to expose or sell that data. So, it makes sense that we'll continue to see attackers trying to find more ways to make victims pay."

Even though identity infrastructure is a prime target for threat actors, identity continues to be at risk in most organizations. In fact, nearly 75% of successful ransomware attacks targeted or exploited the identity system. Only 50% of companies maintain dedicated identity backup systems; and less than half automate identity system recovery. Shockingly, 40% of organizations' disaster recovery or crisis response plans don't include procedures for AD recovery.

"Identity is the coin of the realm. If an attacker can steal an identity, they're off to the races. Insider threats are not always a literal insider—a physical person who's abusing their authority," said Inglis. "Often, it's an internal person acting on an external attacker's behalf to abuse an insider's privileges. Sometimes it's a process that just runs amok. In every case, identity is the core issue."

The full Ransomware Risk Report can be found here: https://www.semperis.com/ransomware-risk-report/

About Semperis
Semperis is the identity-driven cyber resilience and crisis management company trusted by the world's largest enterprises and government agencies to protect critical identity systems. Purpose-built for multi-cloud and hybrid identity environments—including Active Directory, Entra ID, Okta, and Ping Identity—Semperis helps organizations prevent, detect, respond to, and recover from identity-based cyberattacks.

Modern cyberattacks are won or lost at the identity layer, where failures now escalate into full-scale business crises. Semperis' AI-powered platform unifies identity lifecycle defense and crisis management—hardening identity infrastructure, detecting and containing active threats, enabling rapid, trusted recovery, and supporting secure, out-of-band coordination when core systems are disrupted—all reinforced by a world-class identity forensics and incident response team.

As part of its mission to help organizations achieve true cyber resilience, Semperis supports the broader cyber community through the award-winning Hybrid Identity Protection (HIP) Conference and Podcast and free identity security tools including Purple Knight and Forest Druid. More than 1,200 organizations—including over 25% of the 100 largest U.S. companies—rely on Semperis. The company is privately held, headquartered in Hoboken, New Jersey, and serves customers in more than 40 countries.

Learn more: https://www.semperis.com

Media Contact:
Bill Keeler
Senior Director, PR & Comms
[email protected]

SOURCE Semperis